[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwQeArwWf1IoLIMhORcRvK_PKThkFsDYRoIp5zehUJtM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":17,"created_at":18,"published_at":19,"article":20,"tags":24,"podcasts":37},"36ac486b-e998-445a-96cc-a0b83d0a4ad6","new-unc1549-phishing-domains-target-job-seekers-with-fake-recruitment-portal","6f2ef0ef-c4c8-4d8d-b152-1c4eaba5328e","New UNC1549 Phishing Domains Target Job Seekers with Fake Recruitment Portal","The UNC1549 threat actor has launched new phishing domains hosting fake Ebix recruitment portals, continuing their pattern of targeting job seekers with convincing corporate impersonations. This campaign demonstrates how attackers exploit trusted brand names and legitimate-looking recruitment processes to harvest credentials and personal information. The persistence of this threat actor and their ability to rapidly deploy new infrastructure highlights the ongoing challenge of phishing attacks that bypass traditional security measures through social engineering.","**Immediate actions:**\n- Block the newly identified phishing domains using network security tools and DNS filtering\n- Distribute threat intelligence updates to security teams with the latest IOCs\n- Send targeted security awareness communications to employees about this specific threat\n\n**Long-term improvements:**\n- Implement comprehensive security awareness training focused on recruitment and job-related phishing tactics\n- Deploy advanced email security solutions with URL rewriting and sandboxing capabilities\n- Establish regular threat intelligence sharing partnerships with industry groups\n\n**Detection measures:**\n- Monitor network traffic for connections to known UNC1549 infrastructure and similar domains\n- Implement behavioral analytics to detect unusual credential access patterns\n- Configure SIEM alerts for suspicious recruitment-related email activities",[12,13,14,15,16],"CIS Control 14","NIST PR.AT-1","NIST DE.CM-1","NIST RS.CO-2","MITRE ATT&CK T1566.002","published","2026-06-10T12:20:28.308008+00:00","2026-06-10T12:20:28.212+00:00",{"id":7,"url":21,"slug":22,"title":23},"https:\u002F\u002Fx.com\u002Fnextronresearch\u002Fstatus\u002F2064672318446538864","update-we-identified-two-new-unc1549-nimbus-manticore-phishing-domains-hosting-t-e3acd6","Update: We identified two new UNC1549 \u002F Nimbus Manticore phishing domains hosting the same fake E...",[25,31],{"id":26,"name":27,"slug":28,"description":29,"color":30},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[]]