MITRE ATT&CK v20 adds AI abuse, MFA bypass, and utility attacks
Enterprise gains nine entries, ICS adds two campaigns plus analytics, and Mobile restores sideloading and NGate.
61
Threat actor
Nimbus Manticore
- Mentions · 7d0
- Mentions · 30d2
- All mentions6
- First seenAug 26, 2026
- Last mentioned11d ago
Timeline
6 articles · newest firstMITRE ATT&CK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft
MITRE ATT&CK v20 adds Enterprise techniques for prompt injection, AI exfiltration and result poisoning.
63
Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
72
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
55
Iranian cyber spies target aviation, fintech developers with new malware
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
75
Nimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
60
Appears with
- Kasperskyvendor · 4
- UNC1549threat actor · 3
- PollCatmalware · 3
- NodeRabbitmalware · 3
- Salt Typhoonthreat actor · 2
- Smoke Sandstormthreat actor · 2
- MITREvendor · 2
- APT38threat actor · 2
- Microsoftvendor · 2
- Mirage Kittenthreat actor · 2
- The Gentlementhreat actor · 2
- Kasperskyorganization · 2
- Visual Studio Codeproduct · 2
- U.S. water utilitiesvictim · 1
- CrowdStrikevendor · 1
- Cloudflarevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.