Nimbus Manticore expands infrastructure and malware arsenal

Nimbus Manticore, an Iranian state-sponsored hacking group linked to the Islamic Revolutionary Guard Corps, has expanded its operational infrastructure and deployed previously undocumented malware. Group-IB's analysis reveals the group, also known as GalaxyGato and Mirage Kitten, is one of the most active Iranian APT groups, with further coverage provided by The Hacker News.

Nimbus Manticore, associated with the Tortoiseshell (Imperial Kitten) cluster, has been observed using an SSH-based tunneling utility and a C++ backdoor similar to its existing TWOSTROKE implant. This expanded infrastructure, found across Europe and the Middle East, suggests a widening target profile. The group has a history of employing social engineering tactics, such as the "Dream Job" campaign, to deliver malware.

Recent findings also detail the use of a new backdoor called NightLedger and custom WebSocket tunnelers by the group, targeting entities in the Middle East, Africa, and South Asia. The identified tools, including the reverse SSH tunneling tool and the backdoor capable of file manipulation and remote command execution, highlight the actor's evolving capabilities and persistent efforts to maintain access to compromised systems.

Source: The Hacker News