Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack

According to Check Point Research, Nimbus Manticore is an Iranian-aligned threat actor also known as UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operation, targeting defence manufacturers, telecommunications, and aviation entities aligned with IRGC priorities. The group has sharpened its focus on Western Europe, notably Denmark, Sweden and Portugal, using spear-phishing lures impersonating aerospace, defence and telecom recruiters.

Each victim receives a unique URL and credentials for a bespoke fake career portal, with the operation featuring advanced OPSEC and credible pretexting. The actor uses a previously undocumented multi-stage DLL side-loading chain that sideloads malicious libraries from attacker-controlled locations, and the core toolset includes the MiniJunk backdoor and the MiniBrowse stealer, both with valid digital signatures and obfuscation to evade analysis.

Since early 2025, CPR has addressed waves of activity by Nimbus Manticore, a mature Iran-nexus APT targeting across the Middle East and Europe. The campaign demonstrates a nation-state level emphasis on stealth and persistence, with emphasis on delivery, infrastructure and payload layers.