UNC1549
UNC1549 is classified as other threat group.
- Malware families
- 1
- Origin
- Iran
- Also known as
- 1
UNC1549 is an Iranian threat actor linked to Tortoiseshell and potentially the IRGC. They have been active since at least June 2022, targeting entities worldwide with a focus on the Middle East. UNC1549 uses spear-phishing and credential harvesting for initial access, deploying custom malware like MINIBIKE and MINIBUS backdoors. They have also been observed using evasion techniques and a tunneler named LIGHTRAIL in their operations.
The group's reported origin is Iran.
The group is associated with 1 malware families.
Also known as: Nimbus Manticore
The group is associated with 1 malware families.
Malware families
- MiniFast
Published reports on this actor:
- https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east
- https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe
- https://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.