Threat IntelligenceJun 10, 2026
Update: We identified two new UNC1549 / Nimbus Manticore phishing domains hosting the same fake E...
UNC1549/Nimbus Manticore threat actor uses new phishing domains for fake Ebix recruitment portal.
Vendor Watch
Run Ebix?
Get an email when a reviewed story names Ebix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works
Summary
The UNC1549, also known as Nimbus Manticore, threat actor has deployed two new phishing domains. These domains are hosting a fake Ebix recruitment portal, similar to previously reported campaigns. Indicators of Compromise (IOCs) are available for detection.
Indicators of Compromise
- domain — ebix[.]portal-career[.]com
- domain — ebix-exam[.]com
Entities
UNC1549 (threat_actor)Nimbus Manticore (threat_actor)Ebix (product)