Full Report
The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. Russian cybersecurity company Kaspersky is tracking the
Analysis Summary
# Threat Actor: Nimbus Manticore
## Attribution & Identity
* **Actor Name:** Nimbus Manticore
* **Known Aliases:** Iranian Dream Job (tracked by Kaspersky due to recruitment-themed lures)
* **Origin:** Iran
* **Associations:** Similarities in tactics to the North Korea-linked Lazarus Group (recruitment lures), though the actor is confirmed as Iranian.
## Activity Summary
Nimbus Manticore has recently expanded its toolset to include cross-platform Remote Access Trojans (RATs) written in Node.js and JavaScript. The group is currently conducting social engineering campaigns masquerading as talent acquisition specialists at major tech companies. They target software engineers via LinkedIn and other job search platforms, inviting them to complete a "coding challenge" that contains trojanized archives. Recent activity has been detected on systems in Afghanistan, Egypt, and Ethiopia.
## Tactics, Techniques & Procedures
* **Social Engineering:** Posing as recruiters/talent acquisition specialists on professional platforms like LinkedIn.
* **Lure Delivery:** Spear-phishing messages containing links to ZIP archives hosted on AWS (e.g., `Front-Technical-Challenge.zip`).
* **Software Supply Chain Poisoning (Local):** Bundling trojanized npm packages (e.g., `colorized_terminal`) directly in the `node_modules` folder of the provided coding task rather than the public registry.
* **Execution:** Using `server.js` to import malicious packages that launch implants as detached background processes.
* **Evasion:** Using Node.js/JavaScript for cross-platform compatibility (Linux, macOS, Windows); obfuscating JavaScript code; using randomly named `.tmp` files to execute scripts and deleting them immediately after.
* **Persistence/Lateral Movement:** Execution of arbitrary shell commands and reverse SSH tunneling.
## Targeting
* **Sectors:** Technology, Software Engineering (specifically individuals seeking employment).
* **Geography:** Afghanistan, Egypt, Ethiopia.
* **Victims:** Software engineers and technical candidates.
## Tools & Infrastructure
* **Malware Families:**
* **NodeRabbit:** A cross-platform Node.js RAT.
* **PollCat:** An obfuscated JavaScript cross-platform RAT.
* **NightLedger:** A Windows-based backdoor.
* **BridgeHead & ArcBridge:** Custom WebSocket tunnelers.
* **Minifast & TWOSTROKE:** Previously associated backdoors.
* **Infrastructure:**
* **C2 Addresses:**
* plugplay.azurewebsites[.]net
* rgbteller.azurewebsites[.]net
* wslwebui.azurewebsites[.]net
* **Delivery:** AWS-hosted ZIP files.
* **Endpoints:** `/api/rabbit/checkin`, `/api/rabbit/task`, `/api/rabbit/result`.
## Implications
The shift to Node.js and JavaScript signifies a strategic move toward platform-agnostic attacks. By developing cross-platform RATs, Nimbus Manticore can now target Linux-based servers and macOS workstations with the same codebase, significantly expanding their operational reach beyond Windows. The "Iranian Dream Job" campaign demonstrates a high level of sophistication in social engineering, exploiting the trust inherent in the professional recruitment process.
## Mitigations
* **Candidate Awareness:** Educate technical staff and applicants to be wary of recruitment offers that require running unvetted code or archives from unknown sources.
* **Code Sandboxing:** Run any "coding challenges" or external projects in isolated, non-networked virtual machines or containers.
* **Endpoint Monitoring:** Monitor for suspicious `node.exe` or `node` processes spawning detached background tasks, particularly those communicating with Azure-hosted web apps.
* **Network Filtering:** Block known C2 domains (e.g., `*.azurewebsites.net` patterns identified as malicious) and monitor for unauthorized SSH tunneling activity.