Loading story…
An Iran-linked threat actor tracked as Nimbus Manticore—also associated in reporting with Mirage Kitten—has been tied to a cyber-espionage campaign targeting organizations across the Middle East, Africa, and parts of South Asia. Researchers said the operation deployed a newly documented Windows backdoor, NightLedger, alongside two custom WebSocket tunneling tools, BridgeHead and ArcBridge, against victims in sectors including government, telecommunications, aviation, aerospace, finance, and small and medium-sized businesses. Reported victim countries include Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso.
The malware set was designed to support long-term covert access, with NightLedger enabling reconnaissance, command execution, file operations, process discovery, screenshot capture, exfiltration, persistence, and evasion, while BridgeHead and ArcBridge turned compromised systems into operator-controlled relays for hidden communications through victim networks. The initial intrusion vector has not been confirmed, though the actor has previously used tailored phishing lures such as fake job offers and spoofed videoconferencing pages. Researchers also published indicators of compromise, including malicious domains, an IP address, and multiple MD5 hashes to aid detection and threat hunting.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The Gurucul report published indicators of compromise for the campaign, including multiple domains, one IP address, and nine MD5 hashes to support detection and threat hunting. This added technical details beyond the malware and targeting overview.
Security researchers linked an active cyber-espionage campaign to the Iranian state-backed actor tracked as Nimbus Manticore / Mirage Kitten, identifying the NightLedger Windows backdoor and the ArcBridge and BridgeHead tunneling tools. Reported targeting spans organizations in the Middle East, Africa, and South Asia, including telecommunications, aviation, aerospace, financial, government, and SMB sectors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
Nimbus Manticore, an Iranian APT group, has intensified its campaign against European defense, telecommunications, and aviation sectors using sophisticated spear-phishing and custom malware. The group employs advanced techniques such as multi-stage DLL sideloading, heavy obfuscation, and legitimate code signing to evade detection. Their evolving toolset, including the MiniJunk backdoor and MiniBrowse stealer, demonstrates a high level of operational security and resilience.
Jun 29, 2026
Mandiant reported that **UNC1549** targeted aerospace and defense organizations with post-compromise spear-phishing aimed at IT staff and administrators, using reconnaissance from breached inboxes and internal password-reset workflows to steal higher-privilege credentials. The group deployed several custom tools and backdoors, including **MINIBIKE**, **TWOSTROKE**, **DEEPROOT**, and the **LIGHTRAIL** tunneler, while heavily abusing **DLL search-order hijacking** against legitimate software from vendors such as Fortinet, VMware, Citrix, Microsoft, and NVIDIA. TWOSTROKE communicated over SSL on TCP/443 and supported file transfer, execution, in-memory DLL loading, and host discovery, while LIGHTRAIL used Azure-backed WebSocket infrastructure to tunnel traffic and evade detection. The activity aligns closely with earlier reporting on the Iranian-aligned **Mirage Kitten** espionage group, whose malware set included the **NightLedger** backdoor and the **ArcBridge** and **BridgeHead** tunnelers used against aerospace, aviation, defense, telecommunications, government, and financial targets across the Middle East and Africa. Securelist said NightLedger also relied on DLL hijacking by masquerading as `SspiCli.dll`, and its tunnelers provided covert WebSocket-based relay capability with enterprise proxy-aware authentication. The overlap in victimology, tradecraft, and tunneling design suggests UNC1549 is operating with a malware ecosystem strongly connected to Mirage Kitten’s previously documented toolset.
Jul 28, 2026