Iranian APT Uses SEO Poisoning to Spread Fake SQL Developer Malware

A newly observed cyber campaign linked to the Iranian IRGC-affiliated threat group Nimbus Manticore (also tracked as UNC1549) highlights an evolution in both delivery tactics and malware sophistication.

The activity, uncovered during the ongoing geopolitical conflict tied to Operation Epic Fury launched on February 28, 2026, shows the group adopting SEO poisoning malware for the first time to distribute as legitimate software.

Nimbus Manticore has historically targeted aviation, defense, and telecommunications sectors using career-themed phishing lures. In its latest operations, the group expanded targeting across the United States, Europe, and the Middle East, impersonating aviation firms and software providers to lure victims.

Earlier 2026 campaigns relied on phishing emails delivering ZIP archives hosted on legitimate platforms like OnlyOffice. These archives abused AppDomain hijacking, a technique that forces trusted .NET applications to load malicious DLLs באמצעות crafted .config files, enabling stealthy execution.

Victims executing these files unknowingly triggered multi-stage infection chains that deployed updated versions of the group’s MiniJunk malware.

During Operation Epic Fury, the threat actor introduced a more advanced infection chain using a trojanized Zoom installer. The malware mimicked legitimate installation processes while silently deploying malicious components.

Key techniques observed include:

• Abuse of legitimate signed binaries to evade detection.
• Scheduled task hijacking via Zoom update mechanisms for persistence.
• Multi-stage loaders using obfuscation (ROT13 and reversed strings).
• Strict execution checks to evade sandbox environments.

This campaign marked the debut of a new backdoor named MiniFast, replacing MiniJunk. The malware is a 64-bit DLL that enables full remote control over infected systems, including file exfiltration, command execution, and process manipulation.

MiniFast communicates with command-and-control (C2) servers using structured HTTP requests and JSON-based exchanges, impersonating Chrome browser traffic to blend in with legitimate network activity.

Iranian APT Uses SEO Poisoning

Checkpoint said in a report shared with GBhackers, identified a third campaign phase leveraging SEO poisoning. Attackers created a fake website, getsqldeveloper[.]com, posing as a download portal for Oracle SQL Developer.

To boost visibility, the group registered numerous supporting domains. It used keyword stuffing techniques such as “Download SQL Developer” and “SQL Developer Free.” This manipulation pushed the malicious site to high rankings on search engines like Bing and DuckDuckGo.

Users searching for SQL tools were redirected to the fake site and served a malicious installer that delivered the MiniFast backdoor, marking a shift away from traditional phishing toward search-driven infection vectors.

Analysis of the malware revealed multiple indicators of AI-assisted development. The codebase includes:

• Verbose and repetitive function naming patterns.
• Extensive error handling around simple API calls.
• Modular structure despite relatively simple functionality.
• Embedded debug-style messages and detailed logging.

These traits suggest the use of large language models or automated coding tools, enabling faster development cycles and rapid adaptation during active operations.

MiniFast operates as a fully featured backdoor with capabilities including:

• Remote command execution via CMD.
• File upload and download.
• Directory and process enumeration.
• Persistence via scheduled tasks.
• Dynamic configuration of communication intervals.

The malware uses Base64-encoded tasking and supports a wide opcode-based command structure, giving operators granular control over compromised systems.

Nimbus Manticore’s latest campaigns demonstrate a significant shift in operational maturity. The adoption of SEO poisoning, AI-assisted malware development, and stealth-focused execution techniques indicates a rapid evolution driven by wartime conditions.

The expansion into U.S. aviation targets and continued focus on high-value sectors align with Iran’s broader intelligence collection objectives. These developments underscore the increasing convergence of cyber operations and geopolitical conflict, with threat actors accelerating innovation to maintain operational effectiveness.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.