MalwarePublished 22 Sep 2025

Nimbus Manticore Deploys New Malware Targeting Europe

Source Check Point Research

Description

Nimbus Manticore Deploys New Malware Targeting Europe Key Findings Introduction Since early 2025, Check Point Research (CPR) has tracked waves of Nimbus Manticore activity. Known as UNC1549 or Smoke Sandstorm, Nimbus Manticore is a mature Iran-nexus APT group that primarily targets aerospace and defense organizations in the Middle East and Europe. Some of its operations were also previously […] The post Nimbus Manticore Deploys New Malware Targeting Europe appeared first on Check Point Research .

Impact

The deployment of Nimbus Manticore's new malware poses significant risks to European aerospace and defense organizations, potentially compromising the confidentiality of sensitive military and industrial information. Successful intrusions could lead to intellectual property theft, exposure of classified defense projects, and erosion of competitive advantage. Additionally, persistent access may enable future sabotage or disruption of critical systems, affecting operational availability. The espionage-driven nature of the threat means that integrity attacks are less likely but cannot be ruled out. The medium severity reflects the targeted scope and the current lack of widespread exploitation, but the strategic importance of affected sectors amplifies the potential geopolitical and economic consequences. European organizations may face increased risk of data breaches, regulatory scrutiny, and reputational damage if compromised.

Defensive guidance

Organizations should implement targeted threat hunting focused on indicators of compromise associated with Nimbus Manticore, including monitoring for spear-phishing attempts and unusual network activity. Enhancing email security with advanced filtering and user awareness training can reduce initial infection vectors. Network segmentation and strict access controls limit lateral movement within critical infrastructure. Deploying endpoint detection and response (EDR) solutions capable of identifying stealthy malware behaviors is essential. Collaboration with national cybersecurity centers and sharing threat intelligence can improve detection and response capabilities. Regularly updating and patching systems, even in the absence of known exploits, reduces attack surface. Conducting red team exercises simulating APT tactics helps prepare defenses. Finally, implementing multi-factor authentication and restricting privileged account usage further mitigates risk.

Summary

Nimbus Manticore, also identified as UNC1549 or Smoke Sandstorm, is a well-established Iran-affiliated APT group that has been active since at least early 2025 with renewed campaigns deploying new malware targeting Europe. This group specializes in cyber espionage against aerospace and defense sectors, leveraging sophisticated malware to infiltrate networks, maintain persistence, and exfiltrate sensitive data. The malware observed in recent campaigns is designed to evade detection and facilitate long-term access, enabling the group to conduct intelligence gathering on strategic military and industrial projects. While specific technical details of the malware are not disclosed in the provided information, the group's modus operandi typically includes spear-phishing, exploitation of zero-day vulnerabilities, and use of custom backdoors. The targeting of European aerospace and defense organizations aligns with Nimbus Manticore's strategic objectives to monitor and potentially disrupt Western military capabilities. The absence of known exploits in the wild suggests the malware is either newly deployed or used in highly targeted operations. The group's activity underscores the persistent threat posed by state-sponsored actors seeking geopolitical advantage through cyber means.

References

research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Oct 2025, 01:38 UTC

References

Community reviews