Full Report
The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia. The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers,
Analysis Summary
# Threat Actor: Nimbus Manticore
## Attribution & Identity
* **Actor Name:** Nimbus Manticore
* **Aliases:** GalaxyGato, Mirage Kitten, Smoke Sandstorm (Microsoft), Subtle Snail, UNC1549 (Mandiant)
* **Associated Groups:** Linked to Iranian state-backed interests; associated with related activity clusters like Cavern Manticore (Cav3rn).
* **Identity:** An Iranian state-sponsored cyber-espionage group focused on geopolitical intelligence gathering.
## Activity Summary
Recent campaigns (noted in July 2026 reporting) involve the deployment of a new malware suite targeting organizations across Africa, the Middle East, and South Asia. The operations focus on establishing long-term persistence and converting compromised systems into "relay nodes" to facilitate further network intrusion. This activity follows previous 2025/2026 campaigns involving backdoors such as MiniFast and TWOSTROKE.
## Tactics, Techniques & Procedures
* **Initial Access:** Highly tailored phishing lures themed around job opportunities; use of spoofed videoconferencing pages and lookalike branding.
* **Execution:** Use of DLL Side-Loading to launch malicious payloads.
* **Persistence/Lateral Movement:** Use of WebSocket-based tunnelers to turn victim machines into relay nodes, allowing the operator to tunnel TCP traffic through the victim network.
* **Evasion:** Using third-party file-sharing services to host malicious archives; masking C2 traffic as standard HTTPS or WebSocket traffic.
* **Data Collection:** Automated collection of specific diagnostic files (e.g., `NetSetup.log`) to troubleshoot domain joins and mapping environment structures.
* **MITRE ATT&CK Mapping (Inferred):**
* T1566.002: Phishing: Spearphishing Link
* T1574.002: Hijack Execution Flow: DLL Side-Loading
* T1090: Proxy (SOCKS5 tunneling)
* T1113: Screen Capture
* T1071.001: Application Layer Protocol: Web Protocols (HTTP/WebSockets)
## Targeting
* **Sectors:** Government, Aviation, Telecommunications, Financial Services, and Small-to-Medium Businesses (SMB).
* **Geography:** Egypt, Jordan, Tanzania, Pakistan, Ethiopia, Burkina Faso, and the broader Middle East/South Asia regions.
* **Victims:** Specifically mentions aviation organizations in Pakistan and telecom companies in Ethiopia.
## Tools & Infrastructure
* **NightLedger:** A previously undocumented Windows backdoor used for reconnaissance, screenshot capture, and command execution.
* **BridgeHead (unbcl.dll):** A SOCKS5 tunnel proxy used for operator-controlled tunneling.
* **ArcBridge:** A custom WebSocket-based tunneling tool.
* **Legacy/Related Tools:** MiniFast (MiniUpdate), TWOSTROKE, LIGHTRAIL, POLLBLEND, and HOLLOWGRAPH.
* **Infrastructure:**
* C2 delivery via HTTPS POST.
* Use of third-party file-sharing platforms.
* Abuse of Microsoft Graph API for dead-drop C2 (in related HOLLOWGRAPH campaigns).
## Implications
Nimbus Manticore remains a highly adaptive espionage threat. By transitioning from simple backdoors to sophisticated WebSocket tunnelers (BridgeHead/ArcBridge), the actor is effectively turning victim infrastructure against itself, making detection more difficult for defenders who may only see internal-to-internal traffic. Their focus on "diagnostic logs" suggests a highly disciplined approach to understanding the internal architecture of their targets for deep-access persistence.
## Mitigations
* **DLL Sideloading Protection:** Implement strict AppLocker or Windows Defender Application Control (WDAC) policies to prevent the execution of unauthorized DLLs in common directories.
* **Network Monitoring:** Monitor for unusual outbound WebSocket connections and SOCKS5 proxy traffic originating from non-administrative workstations.
* **Email Security:** Deploy advanced email filtering to detect job-themed phishing lures and block known third-party file-sharing domains if not required for business operations.
* **Hunt for Artifacts:** Inspect `C:\Windows\debug\NetSetup.log` access events, as unauthorized collection of this file is a signature behavior for this actor.
* **Zero Trust:** Segment internal networks to prevent relay nodes from accessing sensitive server segments.