Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to UNC1549. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (10)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• attack.mitre.orghttps://attack.mitre.org/groups/G1059
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east
• research.checkpoint.comhttps://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/
• research.checkpoint.comhttps://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/
• proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution
• sophos.comhttps://www.sophos.com/en-us/threat-profiles/cobalt-smokey
• mandiant.comhttps://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east
• research.checkpoint.comhttps://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe
• blog.checkpoint.comhttps://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/