← threat actors
threat actor · IR
UNC1549
also tracked as nimbus manticore 4, mirage kitten 2, dark caracal 1, patchcord 1
4 stories · 4 in the wild · July 18, 2026 – September 2, 2026
evidence: 3 observed · 1 attempted
how they got in
- phishing email 1 · Sep 2
- fake recruiter 1 · Jul 18
sectors
- telecom 2 · Aug 27
- finance 1 · Sep 2
- transport 1 · Sep 2
- critical infrastructure 1 · Aug 27
- government 1 · Jul 29
geography
- afghanistan 2 · Sep 2
- iran 2 · Sep 2
- south asia 2 · Aug 27
- egypt 1 · Sep 2
- ethiopia 1 · Sep 2
- africa 1 · Jul 29
- middle east 1 · Jul 29
malware and tools
- noderabbit 1 · Sep 2
- pollcat 1 · Sep 2
- gocaracal 1 · Aug 27
- twostroke 1 · Aug 27
- nightledger 1 · Jul 29
attack phases seen
- Initial access 3 · Sep 2
- Persistence 2 · Aug 27
- Command and control 1 · Sep 2
- Collection 1 · Aug 27
what we reported, newest first, grouped by story
September 2, 2026
- Nimbus Manticore / Mirage Kitten is now cross-platform, delivering the previously undocumented NodeRabbit and PollCat Node.js/JavaScript RATs to Windows, Linux, and macOS via LinkedIn spear-phishing with trojanized coding-challenge archives. Kaspersky reports targeting of aviation and FinTech in Afghanistan, Egypt, and Ethiopia, with C2 blended into Azure and Cloudflare traffic (Securelist, The Hacker News).
· Sep 2 · observed · via phishing email · as nimbus manticore, mirage kitten · Threat Activity
August 27, 2026
- Nimbus Manticore has expanded its toolset with a TWOSTROKE-like backdoor and an SSH tunneler (The Hacker News), Dark Caracal has added the modular GoCaracal framework for data theft and persistence (Dark Reading), and a new cluster dubbed PATCHCORD is targeting Afghan telecom and South Asian critical infrastructure (Acronis TRU).
· Aug 27 · observed · as nimbus manticore, dark caracal, patchcord · Threat Activity
July 29, 2026
- Iranian state actor Mirage Kitten (Nimbus Manticore / UNC1549) is deploying a new Windows backdoor, NightLedger, plus two custom WebSocket tunnelers that turn victim systems into covert relays, targeting aerospace, telecom and government across the Middle East, Africa and South Asia (The Hacker News, Securelist).
· Jul 29 · observed · as mirage kitten, nimbus manticore · Threat Activity
July 18, 2026
- Iranian APT Nimbus Manticore (UNC1549) ran two fake LinkedIn recruiter accounts with AI-generated photos and LinkedIn work-email verification, impersonating HR at firms previously used in its phishing campaigns (Nextron).
· Jul 18 · attempted · via fake recruiter · as nimbus manticore · Threat Activity