Actor Profile

Nimbus Manticore is an Iranian threat actor also tracked as Iranian Dream Job, known for using recruitment-themed social engineering lures to compromise targets. The group has historically employed malware written in C, C++, and Go, utilizing DLL search-order hijacking techniques. Recent activity demonstrates a strategic shift toward cross-platform capabilities, expanding their toolset to target Linux and macOS systems in addition to Windows. The actor impersonates talent acquisition specialists from major technology companies to deliver trojanized coding challenges via LinkedIn and other job search platforms, a tactic similar to North Korea's Lazarus Group.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved through spear-phishing on LinkedIn and job platforms (T1566.002 - Phishing: Spear Phishing Link), delivering trojanized coding challenge archives. The malware leverages supply chain compromise techniques by bundling malicious npm packages (colorized_terminal, pretty-log) in node_modules directories (T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain). NodeRabbit and PollCat RATs provide command execution (T1059 - Command and Scripting Interpreter), file operations, and system discovery capabilities (T1082 - System Information Discovery, T1057 - Process Discovery, T1083 - File and Directory Discovery). Persistence mechanisms vary by platform: Windows Run registry keys (T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys), cron entries on Linux (T1053.003 - Scheduled Task/Job: Cron), and launch agents on macOS (T1543.001 - Create or Modify System Process: Launch Agent). C2 communication occurs via Azure-hosted infrastructure using HTTP APIs (T1071.001 - Application Layer Protocol: Web Protocols). Defense evasion includes executing scripts from temporary files and immediate deletion (T1070.004 - Indicator Removal: File Deletion), anti-analysis checks, and masquerading as legitimate software updates (T1036 - Masquerading).

Targets & Patterns

Nimbus Manticore targets software engineers and technical professionals through recruitment-themed social engineering, focusing on individuals active on LinkedIn and job search platforms. Observed infections span Afghanistan, Egypt, and Ethiopia, suggesting geographic targeting across Middle East and Africa regions. The use of engineering coding challenges indicates the actor seeks to compromise individuals with technical expertise, potentially for espionage purposes or to gain access to corporate networks through employee systems. The expansion to cross-platform RATs (Linux, macOS, Windows) demonstrates intent to broaden targeting beyond traditional Windows-centric environments, likely reflecting the diverse operating systems used by software development professionals.

Historical Context

Nimbus Manticore has undergone rapid malware arsenal expansion in recent months, adding multiple tools including the NightLedger Windows backdoor, BridgeHead and ArcBridge WebSocket tunnelers, a reverse SSH tunneling tool, and a backdoor overlapping with TWOSTROKE. The NodeRabbit and PollCat RATs represent a significant evolution from the group's historical reliance on C, C++, and Go-based malware and DLL search-order hijacking techniques. The adoption of Node.js and JavaScript for cross-platform capabilities marks a tactical shift toward broader operating system coverage. The group's recruitment-themed social engineering approach mirrors tactics long employed by North Korea's Lazarus Group, though Nimbus Manticore is distinctly Iranian in origin and operates under the Iranian Dream Job moniker for these campaigns.

Defensive Recommendations

  • Monitor for suspicious npm packages bundled in node_modules directories rather than installed from the npm registry, particularly packages with names like colorized_terminal or pretty-log that mimic legitimate utilities
  • Detect T1059 command execution by monitoring Node.js processes spawning shell commands, especially detached background processes launched from .cache or temporary directories
  • Implement behavioral detection for T1547.001 persistence mechanisms: Windows Run registry key modifications mimicking Microsoft Edge or Intel Driver & Support Assistant, unusual cron entries on Linux, and launch agents on macOS
  • Block or monitor outbound connections to Azure-hosted C2 infrastructure (*.azurewebsites.net) with suspicious API endpoint patterns like /api/rabbit/*, /sdk/v2/*, particularly from Node.js processes
  • Train software engineers and technical staff to scrutinize coding challenges from recruiters, verify sender identities through official company channels, and sandbox any test environments before executing provided code

---

# Geopolitical Context

Geopolitical Context

The campaign attributed to Iranian threat actor Nimbus Manticore (also tracked as Iranian Dream Job) represents a tactical evolution in Tehran-aligned cyber espionage operations. By adopting cross-platform malware frameworks built on Node.js and JavaScript—targeting Linux, macOS, and Windows—the group appears to be broadening its operational reach beyond traditional Windows-centric targeting. The use of recruitment-themed social engineering on professional networking platforms mirrors tactics long employed by North Korea's Lazarus Group, suggesting convergence in operational tradecraft among state-aligned actors seeking access to technology sector personnel. Victims identified in Afghanistan, Egypt, and Ethiopia may indicate intelligence collection priorities aligned with Iranian regional interests or broader technology sector reconnaissance. The deployment of trojanized coding challenges reflects sophisticated understanding of software engineering workflows and recruitment practices in the technology sector.

State Actor Alignment

Nimbus Manticore is attributed to Iranian state interests and has been publicly linked to Tehran's cyber operations ecosystem. The group's historical tooling and targeting patterns are consistent with intelligence collection objectives aligned with Islamic Republic strategic priorities. While specific organizational affiliation within Iran's intelligence apparatus has not been definitively established in open sources, the sustained development of custom malware families (including NodeRabbit, PollCat, NightLedger, BridgeHead, and ArcBridge) suggests institutional support and resourcing consistent with state-sponsored operations. The campaign does not appear to be subject to current Western sanctions designations, though Iranian cyber actors broadly operate under existing U.S. and EU sanctions frameworks targeting Iran's intelligence and military organizations.

Business Impacty pro region

The geographic distribution of identified infections—Afghanistan, Egypt, and Ethiopia—may reflect Iranian intelligence priorities in South Asia, the Middle East, and the Horn of Africa, regions where Tehran maintains strategic interests. For European entities, the campaign underscores risks to technology sector personnel and organizations that maintain recruitment operations on international platforms such as LinkedIn. The cross-platform nature of the malware increases risk surface for organizations operating heterogeneous computing environments, particularly those in defense, technology, and critical infrastructure sectors that may be of interest to Iranian intelligence services. The use of cloud infrastructure hosted on Microsoft Azure for command-and-control operations demonstrates adversary adaptation to legitimate enterprise services, complicating network defense and detection efforts across allied nations.

Forecast

If Nimbus Manticore continues to refine its cross-platform capabilities and recruitment-themed social engineering tactics, technology sector organizations globally—particularly those with engineering talent in regions of Iranian strategic interest—are likely to face elevated targeting risk in the coming months. Should Western governments impose additional sanctions or conduct disruptive cyber operations against Iranian infrastructure, Tehran-aligned groups may intensify espionage campaigns targeting defense industrial base and critical infrastructure entities as part of broader strategic competition. If the observed tactical convergence between Iranian and North Korean threat actors continues, defenders may face increased difficulty in rapid attribution and response, particularly when recruitment lures are employed across multiple state-aligned campaigns. Organizations that fail to implement robust vetting of recruitment communications and code execution controls for development environments may remain vulnerable to similar supply chain and social engineering vectors.