Scarred Manticore (Storm-0861) · APT / State-sponsored · RaqibCTI

Knowledge/Actors/Scarred Manticore (Storm-0861)Corpus

+ Request intel workspace

apt

Scarred Manticore (Storm-0861)

active · last signal 2y agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

APT / State-sponsored

Storm-0861Storm-861ShroudedSnooper

Attribution

Iran — Ministry of Intelligence and Security (MOIS)

Origin

Iran

First seen

2023

Last active

2026

Motivation

Espionage

Attribution confidence

high

MENA targeting

Saudi Arabia, UAE, Jordan, Kuwait, Oman, Iraq, Israel

Sectors

Government, military, telecom, IT services, finance, NGOs

Why it mattersState-sponsored / APT actor, high confidence, documented targeting Saudi Arabia, UAE, Jordan (Government, military, telecom sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Related to

UNC1860actorTechnique overlap
Ballistic BobcatactorTechnique overlap
Tropic TrooperactorTechnique overlap
Cl0pactorTechnique overlap
SideWinderactorTechnique overlap
Fox KittenactorTechnique overlap
WIRTEactorTechnique overlap
MuddyWateractorTechnique overlap
Volatile Cedar

Overview Attribution² TTPs²⁰ Indicators Reporting³ Coverage

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

actor

Technique overlap

←Agrius (Agonizing Serpens / BlackShadow)actorTechnique overlap

←Dark CaracalactorTechnique overlap

←APT39 / ChaferactorTechnique overlap

←BladedFelineactorTechnique overlap

←BellaCiao operators (Charming Kitten-linked)actorTechnique overlap

←Nemesis KittenactorTechnique overlap

←MedusaactorTechnique overlap

←DireWolfactorTechnique overlap

←LockBit / LockBit 3.0actorTechnique overlap

→UNC215actorTechnique overlap

←BahamutactorTechnique overlap

←Dust SpecteractorTechnique overlap

←OilRig (APT34)actorTechnique overlap

→WarlockactorTechnique overlap

←Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap

→Stealth FalconactorTechnique overlap

→Void Manticore (Storm-0842)actorTechnique overlap

←Imperial Kitten (CURIUM)actorTechnique overlap

←Qilin (fka Agenda)actorTechnique overlap

→Sea TurtleactorTechnique overlap

←HEXANE (Lyceum)actorTechnique overlap

←Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap

←Charming Kitten / APT42actorTechnique overlap

←APT33actorTechnique overlap

←From Albania to the Middle East: The Scarred Manticore is ListeningreportORKL2024-01-16

←New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel ImplantsreportORKL2024-01-16

←From Albania To The Middle East: The Scarred Manticore Is ListeningreportORKL2023-12-12

Uses

Hijack Execution Flow: DLL Search Order HijackingtechniqueATT&CK mapping
Protocol TunnelingtechniqueATT&CK mapping
Obfuscated Files or Information: Software PackingtechniqueATT&CK mapping
System Information DiscoverytechniqueATT&CK mapping

+16 more relationships — see the relationships browser.

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

ActorVoid Manticore (Storm-0842)
ActorCavern Manticore
ActorAgrius (Agonizing Serpens / BlackShadow)
ActorFlame / Flamer
ActorPredatory Sparrow
ORKLGovernment of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets ↗