NIMBUS MANTICORE

Names and who uses them

• NIMBUS MANTICOREOur name
• UNC1549Mandiant
• COBALT SMOKEYMITRE ATT&CK
• TA455Proofpoint

Targets

Sectors: Defence, Telecommunications, Aerospace, Critical infrastructure

Regions: Europe, United States, Australia

Known techniques

• T1003.006DCSync
• T1007System Service Discovery
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1027Obfuscated Files or Information
• T1027.015Compression
• T1036.004Masquerade Task or Service
• T1036.005Match Legitimate Resource Name or Location
• T1039Data from Network Shared Drive
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1057Process Discovery
• T1059.001PowerShell
• T1059.007JavaScript
• T1070.004File Deletion
• T1070.007Clear Network Connection History and Configurations
• T1071Application Layer Protocol
• T1072Software Deployment Tools
• T1078.002Domain Accounts
• T1078.003Local Accounts
• T1078.004Cloud Accounts
• T1087.001Local Account
• T1087.002Domain Account
• T1098Account Manipulation
• T1105Ingress Tool Transfer
• T1106Native API
• T1110.003Password Spraying
• T1114.001Local Email Collection
• T1136.001Local Account
• T1199Trusted Relationship
• T1204.001Malicious Link
• T1204.002Malicious File
• T1213Data from Information Repositories
• T1213.002Sharepoint
• T1213.005Messaging Applications
• T1534Internal Spearphishing
• T1547.001Registry Run Keys / Startup Folder
• T1552Unsecured Credentials

Malware and tools used