Nimbus Manticore
MITRE G1014Also known as Screening Serpens, UNC1549, Smoke Sandstorm, Nimbus Manticore, GalaxyGato, Mirage Kitten, Subtle Snail, Iranian Dream Job, Tortoiseshell, Imperial Kitten, Unyielding Wasp
Reports
13
First seen
Oct 1, 2025
Last seen
Sep 1, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Top ATT&CK techniques
T1566 Phishing ×11T1041 Exfiltration Over C2 Channel ×6T1059.001 PowerShell ×5T1566.002 Phishing: Spearphishing Link ×5T1110 Brute Force ×5T1087 Account Discovery ×5T1598 Phishing for Information ×4T1071.001 Application Layer Protocol: Web Protocols ×4T1547 Boot or Logon Autostart Execution ×4T1195 Supply Chain Compromise ×4T1005 Data from Local System ×3T1083 File and Directory Discovery ×3
Indicators
filename ×40domain ×31cve ×21hash_sha256 ×12ip_v4 ×4hash_md5 ×1email ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2025-20333 (exploited)CVE-2025-20352 (exploited)CVE-2025-20362 (exploited)CVE-2025-43300 (exploited)CVE-2025-48595 (exploited)CVE-2025-55177 (exploited)CVE-2025-55241CVE-2026-18885CVE-2026-18886CVE-2026-20230 (exploited)CVE-2026-28318 (exploited)CVE-2026-34926 (exploited)CVE-2026-41089 (exploited)CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-49494CVE-2026-74820CVE-2026-75604 (exploited)CVE-2026-81578 (exploited)CVE-2026-82078 (exploited)
Recent reports
High