Actor Profile

Nimbus Manticore is an Iranian threat actor also tracked as Iranian Dream Job, known for using recruitment-themed social engineering lures to compromise targets. The group has historically employed malware written in C, C++, and Go, utilizing DLL search-order hijacking for deployment. Recent activity demonstrates a strategic shift toward cross-platform capabilities, expanding their toolset to target Linux and macOS systems in addition to Windows. The actor masquerades as talent acquisition specialists from major technology companies to deliver malicious payloads through trojanized coding challenge archives distributed via LinkedIn and other job search platforms.

TTPs (Tactics, Techniques, Procedures)

Initial access achieved through spear-phishing on LinkedIn and job platforms (T1566.002 - Phishing: Spear Phishing Link). Malicious ZIP archives contain trojanized npm packages (colorized_terminal, pretty-log) that deploy cross-platform RATs (NodeRabbit, PollCat) written in Node.js and obfuscated JavaScript. Persistence mechanisms vary by OS: Windows Run registry keys (T1547.001), cron entries on Linux (T1053.003), and launch agents on macOS (T1543.001). C2 communication via Azure-hosted infrastructure using REST API endpoints. Capabilities include command execution (T1059), file operations (T1005, T1083), process enumeration (T1057), network adapter discovery (T1016), credential harvesting from Outlook artifacts (T1114.001), and anti-analysis checks. Advanced variants support WSL-specific persistence via scheduled tasks (T1053.005) and fake VS Code extension installation for persistence (T1176).

Targets & Patterns

Nimbus Manticore targets software engineers and technical professionals through recruitment-themed social engineering. Observed infections span Afghanistan, Egypt, and Ethiopia, suggesting targeting of individuals in Middle East and African regions. The use of sophisticated coding challenges requiring three-hour completion windows and restrictions on AI-assisted tools demonstrates targeting of legitimate software development talent. The actor's expansion into cross-platform malware indicates intent to compromise diverse operating system environments beyond traditional Windows targets, particularly Linux and macOS systems commonly used by developers. Credential harvesting from Outlook and VS Code extension persistence mechanisms suggest targeting of corporate development environments.

Historical Context

Nimbus Manticore has undergone rapid malware arsenal expansion in recent months, including the Windows backdoor NightLedger, custom WebSocket tunnelers (BridgeHead, ArcBridge), a reverse SSH tunneling tool, and a backdoor overlapping with TWOSTROKE. The NodeRabbit and PollCat RAT families represent the group's first documented use of Node.js and JavaScript-based cross-platform malware, marking a departure from their historical reliance on C, C++, and Go languages with DLL search-order hijacking techniques. The recruitment-themed social engineering tactic mirrors approaches long employed by North Korea-linked Lazarus Group, though Nimbus Manticore's implementation focuses on technical coding challenges rather than simple job offers.

Defensive Recommendations

  • Monitor for suspicious npm packages bundled in node_modules directories rather than fetched from official registries, particularly packages with names mimicking legitimate terminal/logging utilities
  • Detect T1547.001 (Registry Run Keys) and T1543.001 (Launch Agent) persistence by monitoring for new entries impersonating Microsoft Edge updates or Intel Driver & Support Assistant
  • Implement behavioral detection for Node.js processes spawning detached background processes from hidden cache directories (e.g., node_modules/.cache/)
  • Block or alert on outbound connections to Azure-hosted C2 domains using API endpoints matching patterns /api/rabbit/* or /sdk/v2/* from developer workstations
  • Hunt for WSL-specific persistence mechanisms including daily scheduled tasks executing VBScript files via wscript.exe and wsl.exe, particularly those triggering at 10 a.m.
  • Monitor for unauthorized VS Code extensions, especially those named 'GitHub Copilot Helper' or similar developer-focused tools, and audit extension installation sources
  • Scrutinize unsolicited coding challenges from recruiters on LinkedIn, particularly those with tight time constraints, restrictions on AI tool usage, and instructions not to modify specific files

---

# Geopolitical Context

Geopolitical Context

The campaign attributed to Nimbus Manticore represents an evolution in Iranian cyber espionage tradecraft, mirroring recruitment-themed social engineering tactics historically associated with North Korean threat actors. The shift to cross-platform malware (NodeRabbit and PollCat) using Node.js and JavaScript indicates a strategic adaptation to target diverse operating systems—Linux, macOS, and Windows—expanding the operational reach beyond traditional Windows-focused intrusions. Victims identified in Afghanistan, Egypt, and Ethiopia suggest targeting aligned with Iranian regional intelligence priorities in the Middle East, North Africa, and South Asia. The use of cloud infrastructure (Azure, AWS) for command-and-control and malware delivery reflects a broader trend among state-aligned actors to leverage legitimate services for operational security. The "Iranian Dream Job" moniker underscores the group's sustained reliance on employment lures to compromise software engineers and technology sector personnel, likely for intellectual property theft, supply chain positioning, or long-term access to strategic networks.

State Actor Alignment

Nimbus Manticore is attributed to Iranian state interests and is tracked by the cybersecurity community as an Iranian threat actor. The group's operational patterns—including targeting profiles, infrastructure choices, and malware development trajectories—are consistent with intelligence collection objectives aligned with the Islamic Republic of Iran's strategic priorities. While no specific Iranian government entity is named in the reporting, the group's sustained activity and resource investment suggest state sponsorship or alignment. The campaign does not appear to be subject to current Western sanctions disclosures, though Iranian cyber actors broadly fall under existing U.S. and EU sanctions frameworks targeting Iran's intelligence and military apparatus.

Business Impacty pro region

The geographic distribution of identified victims—Afghanistan, Egypt, and Ethiopia—indicates Iranian cyber operations extending beyond immediate neighbors into strategically significant regions. For Europe, the campaign's reliance on widely used platforms (LinkedIn, cloud services) and targeting of software engineers poses supply chain and insider threat risks, particularly if European technology firms or diaspora communities are approached with similar lures. The cross-platform nature of the malware increases risk to diverse enterprise environments, including those running Linux servers and macOS endpoints common in European tech and research sectors. The adoption of North Korean-style recruitment lures may complicate attribution and incident response, as defenders must now account for overlapping tactics across distinct state actors. Globally, the campaign underscores the convergence of cyber espionage techniques among authoritarian states and the persistent threat to technology sector personnel as high-value targets for initial access and intellectual property theft.

Forecast

If Nimbus Manticore continues to refine cross-platform capabilities and recruitment-themed social engineering, targeting of technology sector personnel in Europe, North America, and allied nations is likely to increase in the coming months. Should the group successfully compromise software engineers at firms with access to critical infrastructure, defense, or telecommunications networks, secondary supply chain compromises may emerge. If Western governments enhance public attribution and sanctions against Iranian cyber actors, operational infrastructure may shift further toward decentralized or bulletproof hosting, though reliance on major cloud providers suggests current risk tolerance. Defensive measures—including heightened scrutiny of unsolicited recruitment outreach, code review of third-party dependencies, and endpoint detection tuned for Node.js-based implants—will be critical to mitigating this threat vector.