CERT24Iran-Linked Hackers Target US Aviation with Phishing and SEO PoisoningLoading data…
CERT24Threat Observatory
Period

Iran-Linked Hackers Target US Aviation with Phishing and SEO Poisoning

The IRGC-affiliated group Nimbus Manticore, also tracked as UNC1549, conducted three waves of activity from February through April 2026, including targeting of the US aviation sector. The campaign used career-themed phishing, counterfeit software downloads and, for the first time for the group, search engine poisoning.

← Back to intelligence

Iran-Linked Hackers Target US Aviation with Phishing and SEO Poisoning

The IRGC-affiliated group Nimbus Manticore, also tracked as UNC1549, conducted three waves of activity from February through April 2026, including targeting of the US aviation sector. The campaign used career-themed phishing, counterfeit software downloads and, for the first time for the group, search engine poisoning.