The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript.
Russian cybersecurity company Kaspersky is tracking the malware strains under the names NodeRabbit and PollCat. The first sample of NodeRabbit was discovered on a system in Afghanistan, with subsequent sightings on two distinct machines located in Egypt and Ethiopia.
“Its operators deliver [NodeRabbit] through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives,” Kaspersky security researcher Omar Amin said. “Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives.”
While Nimbus Manticore has historically employed malware written in C, C++, and Go, and relied on DLL search-order hijacking techniques to deploy them, the latest findings mark the threat actor’s foray into cross-platform tools to accomplish its goals.
The development also comes amid a rapid expansion of the hacking group’s malware arsenal in recent months, including –
- A Windows backdoor called NightLedger
- Two custom WebSocket tunnelers, BridgeHead and ArcBridge
- A reverse SSH tunneling tool
- A backdoor that shares overlaps with TWOSTROKE
The starting point of the suspicious activity observed in the Afghanistan-based system starts with a ZIP file (“Front-Technical-Challenge.zip”) hosted on AWS that’s assessed to have been delivered as part of a job opportunity for an engineering role. The threat actor is said to have masqueraded as a talent acquisition specialist at a major technology company to approach a software engineer and invited them to complete a technical assignment.
It’s worth noting that Nimbus Manticore is also tracked under the moniker Iranian Dream Job for its use of recruitment-themed lures to trick prospective targets into infecting their own computers, a tactic long adopted by the North Korea-linked Lazarus Group.
The archive contains source code for a project management tool called Taskflow and instructs candidates to “find and fix all bugs in the frontend code” as part of an “engineering challenge” within three hours and without relying on artificial intelligence (AI)-assisted tools.
The instructions specifically ask the candidates to refrain from modifying the server component of the application (“server.js”), claiming it’s “bug-free and functions correctly.” However, it’s in this file that the malicious code is embedded.
“The first line of server.js imported a trojanized npm package named colorized_terminal, version 2.1.0,” Kaspersky said. “The attackers bundled the package directly in the challenge task archive’s node_modules directory rather than publishing it to the npm registry. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process.”
The implant in question is NodeRabbit, which communicates with one of three Azure-hosted command-and-control (C2) addresses (“plugplay.azurewebsites[.]net,” “rgbteller.azurewebsites[.]net,” and “wslwebui.azurewebsites[.]net”) through three distinct API endpoints –
- /api/rabbit/checkin, to register agent and host information
- /api/rabbit/task, to poll for commands
- /api/rabbit/result, to send task results
The malware supports 11 commands that allows it to gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read a file in chunks and return Base64-encoded data, decode Base64-encoded text and write it at a chosen file offset, delete a file or recursively delete a directory, create directories recursively, enumerate adapters, MAC addresses, IP addresses, and DNS settings, and alter beacon interval.
Another notable capability of NodeRabbit is to write a Base64-encoded Node.js script to a randomly named “.tmp” file, execute it, and then delete it to cover up traces of malicious activity.
Kaspersky said it identified two more variants of NodeRabbit that share the same code lineage, each recovered from Egypt and Ethiopia –
- A second variant that uses a different trojanized npm package named pretty-log (version 2.1.0) instead of colorized_terminal, while also terminating if found to be running in an analysis environment and partially implementing corporate proxy support
-
A third variant that’s also launched using the pretty-log npm package but uses a different set of API endpoints to accomplish the same tasks –
- /sdk/v2/ready
- /sdk/v2/config
- /sdk/v2/events
Persistence is achieved depending on the operating system: a Windows Run registry key on Windows, a cron entry for Linux, and a launch agent on macOS. The persistence mechanism mimics either a Microsoft Edge browser update (first variant) or Intel’s Driver & Support Assistant (second variant).
The third variant, on the other hand, does not impersonate any legitimate software, but also takes into account the Windows Subsystem for Linux (WSL) to create a daily 10 a.m. Windows task that launches a Visual Basic Script file through wscript.exe and “wsl.exe.” In addition, it features 12 new commands to –
- Enumerate accessible Windows drive letters or WSL-mounted drives
- Execute a process
- Kill process by PID or image name
- Replace the active C2 server and attempt to keep the new configuration
- Return the current C2 server
- Harvest account addresses from Outlook OST and PST artifacts
- Attempt to install a fake VS Code extension named “GitHub Copilot Helper” and Windows Run value for added persistence
- Check selected VS Code, scheduled-task, and Run-key persistence indicators
- Remove the fake extension
- Search recent and common development locations for Git repositories
- Inject a launcher into a repository’s Git hooks for added persistence
- Remove the marked Git-hook launcher
Nimbus Manticore has also been observed using programming challenge lures (“RankChallenge-react-6uJSX3-main.zip”) distributed via time-limited developer assessments to deliver PollCat.
“Although the visible exercise is not a security CTF, the project uses CTF terminology in several places,” Kaspersky said. “The root package is named ctf-server, the backend prints CTF server running, the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf.”
“These repeated labels, together with instructions that do not fully match the delivered application, are consistent with an AI-assisted or template-generated project. One possible explanation is that the attacker prompted an AI coding assistant to create a CTF-style React platform and later inserted the malicious components.”
A PDF tutorial present within the archive prompts the target to click Continue and enter an attacker-supplied six-digit one-time password (OTP) that’s refreshed every 30 seconds, and complete the challenge within a one-hour session. The compressed timeline to activate the assessment is likely an attempt to create a false sense of urgency and make them run the project as soon as possible to increase the likelihood of an infection.
Despite the one-hour session window, PollCat runs independently of the OTP authentication process, unaffected by the success or failure of the OTP validation step. A failed validation prevents the victim from accessing the protected challenge features, while a successful OTP validation issues a JWT and starts an additional PollCat instance.
For persistence, the malware creates a daily scheduled task on Windows, Linux, or macOS, and then connects to a C2 server to send basic host information and await further instructions. It supports 22 commands and communicates via seven API endpoints –
- /beacon, to register the client and obtain a socketId
- /gate/hello, to send host, user, domain, operating system information, and its current privilege level
- /gate/fetch?token=
, to poll for commands - /gate/submit, to submit a Base64-encoded command-result structure
- /vault/
, to fetch a hosted file and write it to the victim machine - /vault/push, to upload a local file or file chunk to the C2
- /gate/track, to report chunk-upload progress
The commands span the typical backdoor gamut, enabling the operator to perform file operations, execute shell commands, upload/download files, run JavaScript, load DLLs, create or extract a ZIP archive, and enumerate running processes, drives, volumes, or mount points. Three commands, namely WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST, are currently not implemented.
PollCat also searches for folders matching 24 hard-coded strings corresponding to software and security vendors, including Google, Microsoft, Palo Alto Networks, Cisco, VMware, Fortinet, Citrix, Check Point, Juniper Networks, LogMeIn, Sophos, Symantec, Trend Micro, McAfee, Kaspersky Lab, ESET, Bitdefender, Avast, CrowdStrike, SentinelOne, Malwarebytes, Brave, Tencent, and Naver.
When a matching folder is found, the malware inventories the folder’s root contents but does not recursively scan the product’s directory. The results are then transmitted in the form of JSON to the “/api/system-details/result” endpoint.
The activity’s links to Nimbus Manticore stem from the structural, command fetching, beacon timing, and command set similarities between PollCat and MiniFast (aka MiniUpdate or Retrograde), a backdoor previously attributed to the group, as well as the use of Azure Websites and Cloudflare‑backed domains for C2.
“The shift to cross-platform scripting gives the operators a single codebase that runs on Windows, Linux, and macOS, with payloads that blend naturally into developer workstations,” Kaspersky said. “The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyber espionage purposes.”
