Loading story…
An Iran-linked threat actor tracked as Nimbus Manticore—also associated in reporting with Mirage Kitten—has been tied to a cyber-espionage campaign targeting organizations across the Middle East, Africa, and parts of South Asia. Researchers said the operation deployed a newly documented Windows backdoor, NightLedger, alongside two custom WebSocket tunneling tools, BridgeHead and ArcBridge, against victims in sectors including government, telecommunications, aviation, aerospace, finance, and small and medium-sized businesses. Reported victim countries include Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso.
The malware set was designed to support long-term covert access, with NightLedger enabling reconnaissance, command execution, file operations, process discovery, screenshot capture, exfiltration, persistence, and evasion, while BridgeHead and ArcBridge turned compromised systems into operator-controlled relays for hidden communications through victim networks. The initial intrusion vector has not been confirmed, though the actor has previously used tailored phishing lures such as fake job offers and spoofed videoconferencing pages. Researchers also published indicators of compromise, including malicious domains, an IP address, and multiple MD5 hashes to aid detection and threat hunting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Gurucul report published indicators of compromise for the campaign, including multiple domains, one IP address, and nine MD5 hashes to support detection and threat hunting. This added technical details beyond the malware and targeting overview.
Security researchers linked an active cyber-espionage campaign to the Iranian state-backed actor tracked as Nimbus Manticore / Mirage Kitten, identifying the NightLedger Windows backdoor and the ArcBridge and BridgeHead tunneling tools. Reported targeting spans organizations in the Middle East, Africa, and South Asia, including telecommunications, aviation, aerospace, financial, government, and SMB sectors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
Mandiant reported that **UNC1549** targeted aerospace and defense organizations with post-compromise spear-phishing aimed at IT staff and administrators, using reconnaissance from breached inboxes and internal password-reset workflows to steal higher-privilege credentials. The group deployed several custom tools and backdoors, including **MINIBIKE**, **TWOSTROKE**, **DEEPROOT**, and the **LIGHTRAIL** tunneler, while heavily abusing **DLL search-order hijacking** against legitimate software from vendors such as Fortinet, VMware, Citrix, Microsoft, and NVIDIA. TWOSTROKE communicated over SSL on TCP/443 and supported file transfer, execution, in-memory DLL loading, and host discovery, while LIGHTRAIL used Azure-backed WebSocket infrastructure to tunnel traffic and evade detection. The activity aligns closely with earlier reporting on the Iranian-aligned **Mirage Kitten** espionage group, whose malware set included the **NightLedger** backdoor and the **ArcBridge** and **BridgeHead** tunnelers used against aerospace, aviation, defense, telecommunications, government, and financial targets across the Middle East and Africa. Securelist said NightLedger also relied on DLL hijacking by masquerading as `SspiCli.dll`, and its tunnelers provided covert WebSocket-based relay capability with enterprise proxy-aware authentication. The overlap in victimology, tradecraft, and tunneling design suggests UNC1549 is operating with a malware ecosystem strongly connected to Mirage Kitten’s previously documented toolset.
Jul 28, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026