As reported by The Hacker News, the Iranian state-sponsored threat actor tracked as Nimbus Manticore — also known under aliases including GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549 — has resurged with a sophisticated new toolset targeting organizations across the Middle East, Africa, and South Asia. The campaign introduces a previously undocumented Windows backdoor called NightLedger, alongside two custom WebSocket-based tunneling tools designed to convert compromised hosts into covert network relays.
Why This Campaign Demands Attention
The operational tradecraft here signals a deliberate evolution in Iranian offensive cyber doctrine. Rather than relying solely on data exfiltration or destructive payloads, Nimbus Manticore is now weaponizing victim infrastructure itself — transforming compromised endpoints into relay nodes that obscure attacker origin and complicate attribution. This is a hallmark of mature, persistent threat actors who have learned to live inside networks quietly rather than announce their presence through noisy lateral movement.
The use of WebSocket tunnelers is particularly notable. WebSocket traffic blends naturally into enterprise environments that rely on modern web applications, SaaS platforms, and cloud-hosted services. Traditional network monitoring tools that inspect protocol headers without deep behavioral analysis will almost certainly miss this traffic. This isn't a gap in attacker capability — it's an intentional exploitation of a defender blind spot.
Who Is at Risk
Nimbus Manticore's targeting profile spans a strategic geography that aligns tightly with Iranian geopolitical interests:
Organizations with remote workforces, hybrid cloud environments, or those relying heavily on VPN-tunneled access are particularly exposed — the covert relay architecture means attacker C2 traffic may appear to originate from trusted internal or partner IP ranges.
The NightLedger Backdoor: What We Know
While full technical indicators are still emerging, the introduction of a previously undocumented Windows backdoor is a significant intelligence marker. Custom tooling at this stage of a campaign typically indicates the group is operating against high-value targets where commodity malware would risk detection, and that prior access via initial access brokers or phishing has already been established. NightLedger's pairing with WebSocket tunnelers strongly suggests it is designed for long-duration persistence rather than smash-and-grab operations.
The architecture of deploying both a backdoor and relay infrastructure simultaneously suggests Nimbus Manticore is not merely gathering intelligence — they are building persistent, resilient footholds that could survive partial remediation efforts.
Broader Strategic Implications
This campaign fits a broader pattern of Iranian threat actors diversifying their toolsets in response to increased Western and regional threat intelligence sharing. The UNC1549 cluster has been previously linked to campaigns against Israeli defense sector targets and has demonstrated an ability to rapidly retool following public disclosures. Security teams that assume a single incident response engagement has fully evicted this actor should reassess — the covert relay model is specifically designed to maintain persistence even after partial cleanup.
The multi-alias nature of this group (at least five tracked names across different vendors) also underscores a critical intelligence challenge: fragmented visibility across vendor threat intel feeds can leave defenders with an incomplete picture of scope and capability.
Shield53 Recommendations
Immediate Actions
- Hunt for WebSocket anomalies: Audit outbound WebSocket connections (ws:// and wss://) from endpoints that have no legitimate business requirement for WebSocket usage. Flag persistent, low-volume WebSocket sessions to uncommon or newly registered domains.
- Baseline Windows services and scheduled tasks: NightLedger-class backdoors commonly achieve persistence via Windows services, scheduled tasks, or registry run keys. Run baseline comparisons against known-good states, particularly on internet-facing systems and executive endpoints.
- Segment and monitor relay-capable hosts: Any system that has initiated unusual outbound tunneling activity should be isolated and forensically examined. Treat these hosts as potentially compromised infrastructure, not just malware carriers.
- Review threat intel subscriptions: Ensure your SIEM and EDR platforms are ingesting IOCs from multiple vendor feeds covering this actor cluster — cross-referencing Smoke Sandstorm (Microsoft), UNC1549 (Mandiant), and Mirage Kitten (CrowdStrike) indicators.
- Enforce application allowlisting: Restrict execution of unsigned or unexpected binaries, particularly in user-writable directories where backdoor droppers commonly stage.
Longer-Term Posture
- Implement network traffic analysis (NTA) solutions capable of behavioral profiling of encrypted tunnel traffic — signature-based detection alone will not suffice against custom WebSocket tunnelers.
- Conduct tabletop exercises simulating partial-eviction scenarios where relay infrastructure survives remediation — test whether your IR playbooks account for this attacker resilience model.
- If your organization operates in the targeted geographies or sectors, consider engaging a threat intelligence retainer for proactive adversary simulation against this specific actor profile.
