# Bohrium

> As of 2026-11-11, Bohrium is a Iran-nexus threat actor tracked by Threadlinqs Intelligence across 3 threats spanning apt, malware. Also known as Imperial Kitten, CURIUM - G1012, Tortoiseshell. ATT&CK coverage spans 46 techniques across 12 tactics in 3 of 3 tracked threats. Most-observed techniques: T1071.001 (Web Protocols), T1027 (Obfuscated Files or Information), T1036.005 (Match Legitimate Resource Name or Location).

- **Nation:** Iran
- **Tracked threats:** 3
- **Categories:** APT, MALWARE
- **Also known as:** Imperial Kitten, CURIUM - G1012, Tortoiseshell
- **As of:** 2026-11-11

## ATT&CK techniques observed

46 techniques observed across 3 of 3 tracked threats. Tactics: Stealth (formerly Defense Evasion) (8), Initial Access (6), Command and Control (5), Credential Access (5), Persistence (5), Collection (4).

- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 3 of 3 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 2 of 3 tracked threats
- [T1204.002](https://intel.threadlinqs.com/technique/T1204.002) Malicious File — Execution — observed in 2 of 3 tracked threats
- [T1547.001](https://intel.threadlinqs.com/technique/T1547.001) Boot or Logon Autostart Execution — Persistence — observed in 2 of 3 tracked threats
- [T1566.002](https://intel.threadlinqs.com/technique/T1566.002) Spearphishing Link — Initial Access — observed in 2 of 3 tracked threats
- [T1572](https://intel.threadlinqs.com/technique/T1572) Protocol Tunneling — Command and Control — observed in 2 of 3 tracked threats
- [T1573.001](https://intel.threadlinqs.com/technique/T1573.001) Symmetric Cryptography — Command and Control — observed in 2 of 3 tracked threats
- [T1574.001](https://intel.threadlinqs.com/technique/T1574.001) DLL — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats
- [T1583.001](https://intel.threadlinqs.com/technique/T1583.001) Domains — Resource Development — observed in 2 of 3 tracked threats
- [T1583.006](https://intel.threadlinqs.com/technique/T1583.006) Acquire Infrastructure: Web Services — Resource Development — observed in 2 of 3 tracked threats
- [T1003.006](https://intel.threadlinqs.com/technique/T1003.006) DCSync — Credential Access — observed in 1 of 3 tracked threats
- [T1008](https://intel.threadlinqs.com/technique/T1008) Fallback Channels — Command and Control — observed in 1 of 3 tracked threats
- [T1027.007](https://intel.threadlinqs.com/technique/T1027.007) Dynamic API Resolution — Stealth (formerly Defense Evasion) — observed in 1 of 3 tracked threats

## Tracked threats

- [Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT](https://intel.threadlinqs.com/threat/TL-2026-5741) — HIGH
- [Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat RATs against aviation and FinTech via fake-recruiter coding challenges](https://intel.threadlinqs.com/threat/TL-2026-4201) — HIGH
- [Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore): New Toolset (TWOSTROKE Backdoor, Reverse SSH Tunnel) and Expanded Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-3923) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Bohrium