Loading threat actor…
Nebulous Mantis is a Russian-speaking, Russia-linked cyber espionage threat actor active since at least mid-2019. The group is tracked under multiple aliases including Cuba, STORM-0978, Tropical Scorpius, UNC2596, CIGAR, and Void Rabisu. It is known for combining espionage operations with cybercriminal tradecraft and for using ransomware deployments to obscure or complement intelligence collection activity. Nebulous Mantis has targeted government entities, critical infrastructure organizations, political figures, and NATO-linked defense organizations. Its operations commonly begin with spear-phishing campaigns that use themed lures and impersonation of trusted services to deliver malware. Earlier activity used the Hancitor loader, while campaigns since mid-2022 have prominently relied on the RomCom remote access trojan. RomCom-enabled intrusions are typically multi-stage and support initial access, persistence, reconnaissance, credential theft, lateral movement, post-exploitation, and exfiltration. Reported tradecraft includes encrypted command-and-control, living-off-the-land techniques, anti-sandbox checks, time-zone analysis, decentralized payload retrieval via IPFS, and persistence through COM hijacking and other registry-based mechanisms. Operators have also used tunneling and archiving utilities, Active Directory and domain enumeration tools, reverse SSH tunnels, and renamed administrative utilities to support stealthy movement and data staging inside victim environments. The group has been observed harvesting credentials, profiling compromised systems, enumerating networks and domains, collecting files and Outlook data, compressing stolen material, and exfiltrating it over encrypted channels. Nebulous Mantis has also deployed ransomware after exfiltration or during later phases of operations. Reported ransomware brands associated with the actor include Cuba, Industrial Spy, and Team Underground, indicating a pattern of blending espionage with extortion-oriented or impact-oriented activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian-speaking espionage group using RomCom RAT in multi-stage intrusions against NATO-linked entities, with LOTL and encrypted C2 noted.
Hybrid espionage + ransomware operations since mid-2019. Uses multi-phase intrusions starting with spear-phishing, then RomCom RAT for execution/persistence/C2, credential harvesting, discovery, and data exfiltration; often deploys ransomware to cover tracks.
Russian-speaking espionage-focused intrusion set using spear-phishing to deliver RomCom RAT, leveraging bulletproof hosting and encrypted C2; targets critical infrastructure, government, political leaders, and NATO-related defense organizations; conducts credential theft, AD enumeration, lateral movement, and data collection/exfiltration.
Russia-linked, Russian-speaking espionage-focused intrusion set targeting NATO-related defense organizations and other critical entities. Uses spear-phishing to deliver RomCom for espionage, lateral movement, credential theft, AD/domain enumeration, and data exfiltration; commonly follows theft with ransomware deployment to cover activity and monetize/impact victims.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.