Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.
- NodeRabbit uses trojanized npm packages bundled locally in challenge archives, avoiding publication to the npm registry.
- RAT communicates with three Azure-hosted C2 servers via /api/rabbit/checkin, /task, and /result endpoints.
- Three variants observed, with the third adding 12 commands including WSL support, Outlook OST/PST harvesting, and Git hook injection.
- Marks Nimbus Manticore's shift from C/C++/Go tooling and DLL hijacking to cross-platform JavaScript implants.
- Actor masqueraded as a talent acquisition specialist and banned AI-assisted tool use in the fake coding challenge.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1547.001 Registry Run Keys / Startup FolderT1053.003 CronT1071.001 Web Protocols
- Vendors
- Kaspersky
- Threat actors
- Nimbus Manticore
- Malware
- NodeRabbitPollCat
- Organizations
- Kaspersky
- Countries
- IranAfghanistanEgyptEthiopia
From the original article
6 min read at thehackernews.com
The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node. js and JavaScript.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.