Nimbus Manticore Shifts to Node.js RATs in LinkedIn Job Lures Targeting Afghanistan and East Africa

The operation began with a trojanized Front-Technical-Challenge.zip containing Taskflow source code. The malicious colorized_terminal npm package in node_modules launched NodeRabbit from a detached background process in server.js. Commands include file exfiltration in Base64 chunks, directory enumeration, and C2 polling via three Azure endpoints. PollCat, an obfuscated JavaScript RAT, followed identical delivery. Evidence from Kaspersky telemetry shows the first sample on an Afghan host with later hits in Egypt and Ethiopia. Contract and procurement patterns indicate Iranian state interest in regional infrastructure monitoring rather than broad espionage.

This marks Nimbus Manticore's departure from C/C++/Go implants and DLL hijacking toward cross-platform Node.js and JavaScript tooling. The recruitment-themed vector, previously tracked as Iranian Dream Job, mirrors Lazarus Group tradecraft but targets software engineers in conflict-adjacent states. Official attribution rests solely on Kaspersky infrastructure correlation; no independent technical attribution or victim statements confirm state sponsorship. Procurement records for similar Azure domains remain unexamined.

Expansion of the group's recent arsenal—NightLedger, BridgeHead, ArcBridge—suggests accelerated development cycles. Next operations will likely reuse the same Azure pattern and coding-test lures against additional Middle East and Horn of Africa engineering targets within the next quarter.