Loading story…
Nimbus Manticore, an Iranian APT group, has intensified its campaign against European defense, telecommunications, and aviation sectors using sophisticated spear-phishing and custom malware. The group employs advanced techniques such as multi-stage DLL sideloading, heavy obfuscation, and legitimate code signing to evade detection. Their evolving toolset, including the MiniJunk backdoor and MiniBrowse stealer, demonstrates a high level of operational security and resilience.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published findings on the campaign, attributing the activity to Nimbus Manticore and detailing the fake job portal lures, malware chain, European targeting, and infrastructure changes. The report brought together the new malware families, victimology, and links to related clusters.
Researchers identified a separate but related activity cluster using a dxgi.dll hijack chain and simpler obfuscation, but sharing code with MiniJunk. This suggested that multiple operators may be using a common Nimbus Manticore-linked toolkit.
Check Point reported a recent increase in targeting of Western Europe, especially Denmark, Sweden, and Portugal, while the group continued operations against Middle East targets. Victims included job-seeking professionals in aerospace, defense manufacturing, telecommunications, and critical infrastructure sectors.
Researchers found the group evolved from the earlier Minibike/SlugResin implant to a new toolset including the MiniJunk backdoor and MiniBrowse browser credential stealer. The malware uses DLL sideloading, obfuscation, rotating HTTPS command-and-control, and theft of Chrome and Edge credentials.
An Iran-linked threat actor tracked as Nimbus Manticore conducted a long-running espionage campaign impersonating recruiters and career portals to target aerospace, defense, telecom, and related professionals in Europe and the Middle East. The activity overlaps with tracking names UNC1549, Smoke Sandstorm, and the previously documented 'Iranian Dream Job' campaign.
In June 2025, the operators updated their infrastructure to blend Cloudflare fronting with Microsoft Azure App Service hosting to improve resilience, credibility, and evasion. Researchers also noted use of career-themed domains and valid SSL.com code-signing certificates to support the operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 75 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
12 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourceindustrialcyber.co
Open sourcego.theregister.com
Open sourceresearch.checkpoint.com
Open sourceoutpost24.com
Open sourcesocket.dev
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
An Iran-linked threat actor tracked as **Nimbus Manticore**—also associated in reporting with **Mirage Kitten**—has been tied to a cyber-espionage campaign targeting organizations across the Middle East, Africa, and parts of South Asia. Researchers said the operation deployed a newly documented Windows backdoor, **NightLedger**, alongside two custom WebSocket tunneling tools, **BridgeHead** and **ArcBridge**, against victims in sectors including government, telecommunications, aviation, aerospace, finance, and small and medium-sized businesses. Reported victim countries include Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso. The malware set was designed to support long-term covert access, with **NightLedger** enabling reconnaissance, command execution, file operations, process discovery, screenshot capture, exfiltration, persistence, and evasion, while **BridgeHead** and **ArcBridge** turned compromised systems into operator-controlled relays for hidden communications through victim networks. The initial intrusion vector has not been confirmed, though the actor has previously used tailored phishing lures such as fake job offers and spoofed videoconferencing pages. Researchers also published indicators of compromise, including malicious domains, an IP address, and multiple MD5 hashes to aid detection and threat hunting.
Jul 31, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026