From f19ef549840a8d55bdbc41c9e4c25db5985c651d Mon Sep 17 00:00:00 2001
From: Jonathan Peters <143413578+cod3nym@users.noreply.github.com>
Date: Wed, 10 Jun 2026 13:19:28 +0200
Subject: [PATCH] Add IOCs for UNC1549

---
 iocs/c2-iocs.txt | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/iocs/c2-iocs.txt b/iocs/c2-iocs.txt
index 4429cd9a..d191c025 100644
--- a/iocs/c2-iocs.txt
+++ b/iocs/c2-iocs.txt
@@ -1912,7 +1912,7 @@ repocket.com
 env-check.daemontools.cc
 38.180.107.76
 
-# Nimbus Manticore (UNC1549) APT Backdoor 2026-05-26 (MAL, APT)
+# Nimbus Manticore (UNC1549) APT Backdoor 2026-05-26 https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/
 globalitconsultants.azurewebsites.net
 globalbusiness-checkers-it.azurewebsites.net
 global-check-business-it.azurewebsites.net
@@ -1926,4 +1926,9 @@ ebix-exam-join-from-app.azurewebsites.net
 business-joiners-exam.azurewebsiets.net
 join-exam-now-ebix.azurewebsites.net
 
+# Phishing Fake Hiring Portals https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/
+ebix.portal-career.com
+ebix-exam.com
+ebix.recruitment-flow.com
+
 # Last Line