Nimbus Manticore Uses Fake Jobs to Spread Cross-Platform RATs

The Iranian-linked threat actor Nimbus Manticore is conducting sophisticated social engineering campaigns disguised as job recruitment processes. Targeting software developers and IT professionals, the group delivers cross-platform Remote Access Trojans (RATs) through fake coding assessments. The malware supports Windows, macOS, and Linux systems, demonstrating significant operational sophistication and a clear focus on credential harvesting and persistent access across diverse computing environments.

Introduction

Job recruitment scams have evolved from simple phishing attempts into elaborate, multi-stage attack vectors that exploit professional ambitions. Nimbus Manticore, also tracked as TA455 and Yellow Garuda, has refined this approach to target technology professionals with unprecedented precision.

The campaign leverages the job-seeking behavior of developers, particularly those in the cryptocurrency, blockchain, and financial technology sectors. By impersonating legitimate recruiters from reputable companies, attackers establish trust before delivering malicious payloads disguised as technical assessments.

What distinguishes this operation is the deployment of cross-platform RATs capable of compromising Windows, macOS, and Linux systems—reflecting the diverse development environments used by targeted professionals. This multi-platform capability significantly expands the attack surface and demonstrates advanced malware development capabilities.

Background & Context

Nimbus Manticore has operated since at least 2021, with confirmed links to Iranian state interests. The group primarily targets individuals and organizations involved in Middle Eastern geopolitics, defense technology, and critical infrastructure sectors.

Previous campaigns attributed to this actor group have employed similar social engineering tactics, including fake job offers, recruitment schemes, and professional networking deception. The group has historically focused on intelligence collection, credential theft, and establishing persistent access to target networks.

The fake recruiter methodology isn’t new to Iranian threat actors. Groups like Charming Kitten (APT35) have previously used similar techniques. However, Nimbus Manticore’s implementation shows evolution in technical sophistication, particularly in cross-platform malware deployment and operational security.

The current campaign specifically targets software engineers, DevOps professionals, and security researchers—individuals who typically have elevated access to source code repositories, production systems, and sensitive intellectual property. This targeting pattern suggests intelligence collection objectives rather than financial motivation.

Technical Breakdown

The attack chain begins with initial contact through professional networking platforms like LinkedIn, Indeed, or direct email. Attackers pose as recruiters from legitimate technology companies or cryptocurrency firms, often impersonating real HR personnel.

Stage 1: Social Engineering

The attacker initiates conversation about attractive job opportunities, discussing compensation packages, role responsibilities, and company benefits. This preliminary phase builds rapport and establishes legitimacy. Communication may span several days to avoid suspicion.

Stage 2: The Coding Test

Once the target expresses interest, the attacker sends a technical assessment or coding challenge. This is delivered as a compressed archive containing what appears to be a legitimate development project. The archive typically includes:

• README files with instructions
• Sample code or project scaffolding
• Dependency files (package.json, requirements.txt, etc.)
• Malicious executables or scripts disguised as build tools

Stage 3: Payload Execution

The malicious component is often embedded within seemingly legitimate development workflows:

# Example malicious npm script
{
  "scripts": {
    "install": "node setup.js && ./config/init_binary",
    "test": "jest && ./verify_env"
  }
}

When developers run standard commands like npm install or follow the provided instructions, they inadvertently execute the malicious payload.

Stage 4: RAT Deployment

The cross-platform RATs deployed in this campaign exhibit the following capabilities:

• Keylogging: Capture keyboard input including credentials and sensitive communications
• Screen capture: Periodic screenshots of active windows and desktops
• File exfiltration: Targeted collection of documents, source code, and configuration files
• Command execution: Remote shell access for arbitrary command execution
• Persistence mechanisms: Registry modifications (Windows), LaunchAgents (macOS), systemd services (Linux)

The malware employs platform-specific techniques for stealth and persistence:

# Example persistence mechanism (Linux)
import os
import subprocess

service_content = """
[Unit]
Description=System Update Service

[Service]
ExecStart=/usr/local/bin/.sysupdate
Restart=always

[Install]
WantedBy=multi-user.target
"""

subprocess.run(['systemctl', 'enable', 'sysupdate.service'])

Communication Infrastructure

Command and control (C2) communication uses encrypted channels over HTTPS, blending with legitimate web traffic. The malware contacts domains that mimic legitimate services or uses compromised WordPress sites as C2 proxies.

Impact & Risk Assessment

Immediate Threats:

Organizations employing targeted individuals face several critical risks. Compromised developer workstations often contain:

• Source code repositories with proprietary algorithms
• API keys and authentication tokens
• VPN credentials and internal network access
• Customer data and sensitive business information
• Intellectual property and trade secrets

Severity Classification: HIGH

The cross-platform nature of these RATs means heterogeneous environments offer no protection. Organizations using macOS for development workstations and Linux for servers remain equally vulnerable.

Long-term Implications:

Successfully compromised developers can serve as initial access brokers for subsequent attacks. Persistent access enables:

• Supply chain attacks through compromised code commits
• Lateral movement into corporate networks
• Long-term intelligence collection
• Manipulation of software releases

The cryptocurrency and blockchain sectors face elevated risk given Nimbus Manticore’s documented interest in these industries. Theft of private keys, wallet credentials, or smart contract vulnerabilities could result in direct financial losses.

Risk to Job Seekers:

Individual targets face personal and professional consequences including identity theft, credential compromise across multiple platforms, and potential legal implications if their compromised systems are used for subsequent attacks.

Vendor Response

Security researchers from multiple organizations have published indicators of compromise (IOCs) and detailed technical analysis of Nimbus Manticore’s infrastructure. Threat intelligence platforms now include detection signatures for the associated RATs.

Major endpoint protection vendors have updated their detection engines to identify the specific malware families deployed in these campaigns. However, the attackers continuously modify payloads to evade signature-based detection.

Professional networking platforms have been notified of the malicious accounts, though the creation of new fake recruiter profiles remains an ongoing challenge. Some platforms have implemented additional verification requirements for recruiters posting job opportunities in sensitive sectors.

Government cybersecurity agencies, including CISA and various national CERTs, have issued advisories warning technology professionals about the threat and providing guidance for verification of legitimate recruitment activities.

Mitigations & Workarounds

For Organizations:

Implement strict policies regarding personal projects and external code execution on corporate devices:

# Example AppLocker policy (PowerShell)
New-AppLockerPolicy -RuleType Publisher,Path,Hash 
-User Everyone -Deny -Path "C:\Users\\Downloads\"

Deploy application whitelisting to prevent unauthorized executable execution. Maintain separate, isolated environments for evaluating external code or participating in technical assessments.

For Individual Developers:

Never execute code from unknown sources on primary development machines. Use dedicated virtual machines or containers for technical assessments:

# Isolated Docker environment for code evaluation
docker run --rm -it --network none \
  -v $(pwd)/assessment:/code:ro \
  ubuntu:latest /bin/bash

The --network none flag prevents any network communication, limiting potential malware C2 connectivity.

Verification Procedures:

Before engaging with recruiters:

• Verify recruiter identity through official company channels
• Check LinkedIn profiles for connection history and activity patterns
• Request interviews through official company email domains
• Never download files from personal cloud storage links
• Confirm job postings on official company career pages

Detection & Monitoring

Network-Level Detection:

Monitor for unusual outbound connections from developer workstations, particularly to recently registered domains or hosting providers commonly abused for C2 infrastructure:

# Monitor for suspicious DNS queries
tcpdump -i eth0 -n 'udp port 53' | \
  grep -vE '(google|cloudflare|amazon)'

Endpoint Detection:

Look for unexpected persistence mechanisms:

# Audit Linux systemd services
systemctl list-unit-files | grep enabled | \
  while read service _; do
    systemctl cat $service | grep -i "ExecStart"
  done

Behavioral Indicators:

• Unexpected npm/pip/gem install scripts executing binaries
• New cron jobs or scheduled tasks created without administrator action
• Unusual process trees originating from development tools
• Encrypted network traffic to non-standard ports
• File access patterns indicating systematic data collection

SIEM Rules:

Configure alerts for:

• Multiple failed authentication attempts followed by success
• Large file transfers to external destinations
• Execution of compilers or interpreters with suspicious arguments
• Modification of shell configuration files (.bashrc, .zshrc)

Best Practices

Secure Development Practices:

Maintain air-gapped systems for evaluating untrusted code. Never use production credentials or keys in development or testing environments.

Implement principle of least privilege across development infrastructure. Developers should not require administrative access for routine tasks.

Security Awareness:

Conduct regular training on social engineering tactics specific to the technology sector. Include realistic scenarios involving fake recruiters, coding challenges, and professional networking deception.

Encourage reporting of suspicious recruitment contacts without fear of repercussions. Create clear channels for security team consultation regarding unusual requests.

Technical Controls:

Enable full disk encryption and require secure boot on all development workstations. Deploy EDR solutions with behavioral analysis capabilities, not just signature-based detection.

Implement multi-factor authentication across all platforms, prioritizing phishing-resistant options like hardware tokens or biometric authentication.

Code Review Processes:

Even for personal technical assessments, apply security scrutiny:

• Read all scripts before execution
• Review package.json, requirements.txt, and similar files for suspicious post-install scripts
• Check file permissions and unexpected binary files
• Use static analysis tools on provided code
• Search for base64-encoded content or obfuscated code

Key Takeaways

• Iranian threat actor Nimbus Manticore is actively targeting software developers through sophisticated fake recruitment campaigns
• Cross-platform RATs supporting Windows, macOS, and Linux demonstrate advanced malware development capabilities
• Technical assessments and coding challenges serve as delivery mechanisms for initial compromise
• Organizations must implement policies separating personal projects from corporate infrastructure
• Individual developers should use isolated environments for evaluating external code
• Verification of recruiter identity through official channels is essential before engaging
• The campaign represents ongoing evolution in social engineering tactics targeting the technology sector
• Detection requires combination of network monitoring, endpoint security, and user awareness

The Nimbus Manticore campaign illustrates how threat actors exploit professional behavior patterns to achieve compromise. As remote work and online recruitment become standard practice, the boundary between personal career development and organizational security continues to blur. Both individuals and organizations must adapt security practices to address this evolving threat landscape.

References

• Proofpoint Threat Research – “TA455: Iranian Actor Targets Defense and Aerospace”
• MITRE ATT&CK – T1566.001 (Phishing: Spearphishing Attachment)
• CISA Alert AA23-XXX – “Iranian Threat Actors Target Technology Sector”
• Recorded Future – “Yellow Garuda: Profile of an Iranian Threat Actor”
• VirusTotal – IOC collection for Nimbus Manticore infrastructure
• NIST Cybersecurity Framework – PR.AT-1 (Security Awareness Training)

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/