Cybersecurity researchers have uncovered new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the…
NightLedger is a Windows backdoor used by Nimbus Manticore, as detailed in a Kaspersky report. It is used to maintain persistent access…
BridgeHead is a custom WebSocket tunneler used by Nimbus Manticore to maintain persistent access to compromised systems. It is part of the…
ArcBridge is another custom WebSocket tunneler used by Nimbus Manticore. It facilitates secure communications between compromised hosts and C2 infrastructure, helping the…
MiniFast, also known as MiniUpdate and Retrograde, is a tunneling tool with functional overlaps to BridgeHead, used by Nimbus Manticore.
LIGHTRAIL is a bespoke tunneling utility previously used by Nimbus Manticore, part of the group's continued reliance on tunneling tools.
POLLBLEND is a bespoke tunneling utility previously used by Nimbus Manticore, part of the group's continued reliance on tunneling tools.
Iranian state-backed hacking group Nimbus Manticore (also known as GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been linked to…
Nimbus Manticore, also known as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549, is an Iranian state-sponsored hacking group…