Nimbus Manticore APT Uses Fake Jobs to Deliver Custom Malware

A newly observed cyber campaign linked to the Iran-aligned threat group Nimbus Manticore (also tracked as UNC1549 and Smoke Sandstorm) is targeting aerospace and defense organizations using a deceptive recruitment workflow that delivers custom malware through a sophisticated sideloading chain.

The operation highlights the group’s continued reliance on social engineering combined with stealthy execution techniques to evade detection.

The interaction included a well-crafted PDF job description outlining responsibilities and benefits, reinforcing credibility.

Victims were directed to a fake recruitment portal hosted on a lookalike domain, designed to closely mimic legitimate hiring platforms. Access to the portal required credentials provided by the attacker, adding a layer of exclusivity and trust.

Once logged in, users were prompted to download a “two-factor authentication” application as part of the hiring process.

This application, delivered as a ZIP archive, served as the entry point for the malware infection.

The infection chain leverages a renamed, legitimate Microsoft-signed binary (ServiceHub.VSDetouredHost.exe) to sideload a malicious DLL named TOTPGuard.dll.

The attackers manipulate the .NET runtime using a crafted configuration file to perform AppDomain hijacking, a technique that alters how dependencies are resolved at runtime.

Because the executable is signed by Microsoft, it appears trustworthy, reducing the likelihood of detection. Once executed, the malicious DLL is loaded, presenting the victim with a fake but functional 2FA interface to maintain the illusion of legitimacy.

Nextron said in a report shared with GBhackers, the attack begins with a highly tailored lure delivered via LinkedIn. In the investigated case, the threat actor impersonated a professional recruiter offering a lucrative $200,000 salary opportunity with Ebix, a legitimate global software company.

Behind the scenes, the malware decrypts an embedded payload using hardcoded AES keys and writes it to disk at AppData\Roaming\2FAGuard\main.dll.

The stager then establishes persistence by creating a scheduled task named “BackupCheck,” which executes the payload at user logon with minimal privileges to avoid suspicion.

Nimbus Manticore APT

The final payload is a native implant designed for data exfiltration and remote command execution. It includes several anti-analysis techniques, such as checking process names and inspecting system flags to detect debugging environments. If anomalies are found, execution is halted.

The fake application continues the hiring portal flow and provides enough functionality to make the 2FA prompt appear credible.

Compared to earlier campaigns documented by security researchers, this variant introduces heavier obfuscation, including indirect jumps, opaque predicates, and junk code insertion.

Despite these enhancements, the core functionality remains consistent with previous Nimbus Manticore implants.

Command-and-control communication relies on Azure-hosted infrastructure, using domains that blend with legitimate cloud services. API endpoints such as /agent/init and /agent/poll facilitate communication, while a standard browser user-agent string helps mask malicious traffic.

Analysis of the campaign revealed several detection opportunities. The use of newly registered domains, particularly for login portals and downloads, is a strong early indicator of malicious activity.

Additionally, artifacts such as the “doit” execution argument, the “BackupCheck” scheduled task, and the AppData\Roaming\2FAGuard directory provide valuable hunting signals.

The attackers also reused identifiable metadata in lure documents, including a consistent PDF author string, enabling defenders to track related phishing artifacts across campaigns.

Organizations are advised to expand security awareness programs to include social media-based phishing scenarios, as attackers increasingly move beyond traditional email vectors.

Restricting execution from user-writable directories and monitoring unusual .NET configuration behavior can further reduce risk.

This campaign demonstrates how Nimbus Manticore continues to refine its techniques while maintaining consistent operational patterns.

By combining credible social engineering with trusted binaries and cloud infrastructure, the group effectively blends malicious activity into normal enterprise environments, complicating detection and response efforts.

IOCs

Hash	Description / Filename
06d12a4c4e3cc725dba37445cebeba41803718ccdb63d9d637355a241f651668	Fake Airbus Job Description PDF
9b63b744dc1f3a24f057a404c5622ed0ca933752a00ce05117727c7d11f05536	Fake Airbus Job Description PDF
620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b	Fake Ebix Job Description PDF
d1f525eb9347133b92e9558e1413558c8348c0f35a62577f60a5192ba38eb776	TOTPGuard.zip
8e5fc0998838559ca8611e6c03fd998a17ffc2eade24715b2fc3e723c712eb8b	setup.exe.config
eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71	TOTPGuard.dll
dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee	main.dll
3628d13d2f8af7663d58dd1aa352c8f12d12233a7318ee203f01f195573a2ed2	EbixExam.Desktop.zip
c7ef2ec19d158301773b1590f5b5eeb362a30f725acad8f5b3a230e9f26d14be	EbixExam.Updater.dll
072744ce205bb89a36e563a86f30df5689e64eee75106b97ce708551c8194bbc	EbixExam.Updater.ServiceHub.dll

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.