As reported by The Hacker News, Group-IB has published new findings on Nimbus Manticore — an IRGC-affiliated Iranian APT also tracked under at least seven aliases including Mirage Kitten, Smoke Sandstorm, and UNC1549 — revealing previously undocumented malware tools and expanded infrastructure spanning Europe and the Middle East.

Threat Intelligence: As reported by The Hacker News, Group-IB has published new findings on Nimbus Manticore — an IRGC-affiliated Iranian APT also tracked under at least seven aliases including Mirage Kitten, Smoke Sandstorm, and UNC1549 — revealing previously undocumented malware tools and expanded infrastructure spanning Europe and the Middle East.

What makes this development significant is not novelty of technique but the operational scaling it represents. The discovery of a reverse SSH tunneling utility disguised as a Windows Terminal Server SDK component and a C++ backdoor masquerading as wtsapi32.dll indicates a deliberate investment in DLL sideloading and traffic-tunneling tradecraft. This is a group maturing its toolset to sustain long-duration espionage operations against harder targets.

Why This Matters

Nimbus Manticore's lineage traces back to Tortoiseshell and the broader Charming Kitten cluster — actors with a documented history of targeting defense, aerospace, IT service providers, and military organizations since at least 2018. The group's Dream Job campaign variants have already demonstrated sophisticated social engineering. The addition of WebSocket-based tunnelers (BridgeHead, ArcHead per Kaspersky) and now reverse SSH tunneling suggests the actor is building redundancy into its persistence and C2 channels — a hallmark of operations designed to survive incident response.

The infrastructure expansion into European countries alongside continued Middle Eastern focus signals a broadened targeting profile. Organizations that previously considered themselves outside this group's scope — particularly European defense contractors and IT consultancies with Middle Eastern government clients — should reassess their threat model.

Technical Detection Focus

  • DLL Masquerading: Both newly discovered tools impersonate legitimate Windows Terminal Server components. Monitor for wtsapi32.dll loaded from non-standard paths and unsigned copies of SDK-named libraries.
  • Reverse SSH Tunneling: The SSH tunneling utility connects to C2 on port 443 — deliberately blending with legitimate HTTPS traffic. Detect outbound SSH handshakes on 443 and unexpected Plink or OpenSSH client processes originating from service accounts.
  • C2 Infrastructure: Group-IB identified the SSH endpoint at 172.86.98[.]113. Three hard-coded HTTPS C2 servers support the backdoor. Network defenders should immediately check proxy and firewall logs for historical connections.
The use of three hard-coded C2 servers in a single backdoor is a resilience design choice — the operator expects individual infrastructure takedowns and has pre-built failover. This is not opportunistic crime; it's sustained state-sponsored access engineering.

Who Is at Risk

Primary targets remain defense, aerospace, military, and IT service provider organizations — particularly those with Middle East operations or Israeli, Gulf state, or U.S. government relationships. European entities in these sectors are now at elevated risk given the infrastructure expansion. Recruitment-themed social engineering remains a primary initial access vector.

Shield53 Recommendations

Shield53 Recommendations
Hunt for IOCs: Search endpoint telemetry for wtsapi32.dll in non-system directories, SSH client binaries in unexpected locations, and outbound connections to 172.86.98[.]113.
Application Whitelisting: Enforce DLL loading path restrictions for system-mimicking libraries. Use WDAC or AppLocker to block unsigned DLLs from user-writable paths.
Network Behavioral Detection: Deploy rules for SSH protocol traffic on port 443 and long-lived outbound HTTPS sessions from non-browser processes. EDR should flag process injection and masquerading behavior.
Phishing Resilience: Brief employees — especially those in defense and aerospace — on recruitment-themed lures. Job opportunity social engineering remains this group's primary entry method.
Threat Intel Integration: Subscribe to Group-IB and Kaspersky threat feeds for Nimbus Manticore IOC updates. The group's rapid toolset evolution means indicators have a short shelf life.

This is a group that has survived multiple public attributions and toolset disclosures — a sign of state backing and operational resilience. Defenders should assume Nimbus Manticore will continue iterating faster than detection content can be published, and invest accordingly in behavioral detection over static IOCs.