The Hacker Newsinfo@thehackernews.com (The Hacker News)
NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays
Part of the UNC1549 story · since 19 Sep 2025
Quiet for 8 weekslast report 7 Sep18 articles9 outlets
- Fri 19 Sep, 16:30 UTC. The Hacker News, first report. UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware.
- Mon 22 Sep, 13:05 UTC. Check Point, its first report on the story. Nimbus Manticore Deploys New Malware Targeting Europe.
- Tue 23 Sep, 08:13 UTC. GBHackers, its first report on the story. Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack.
- Wed 24 Sep, 01:16 UTC. SecurityOnline, its first report on the story. Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe.
- Tue 18 Nov, 22:26 UTC. Dark Reading, its first report on the story. Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace.
- Wed 19 Nov, 03:20 UTC. SecurityOnline. Iranian APT UNC1549 Infiltrates Aerospace by Hijacking Trusted DLLs and Executing VDI Breakouts.
- Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
- Fri 22 May, 15:48 UTC. Check Point. Iranian hackers revive with SEO poison, fake Zoom and AI backdoor.
- Tue 26 May, 09:18 UTC. The Hacker News. Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO Poisoning.
- Tue 26 May, 09:18 UTC. Security Affairs, its first report on the story. Iranian hackers use AI malware, SEO tricks in US aviation attacks.
- Tue 26 May, 09:18 UTC. Infosecurity. Nimbus Manticore hackers hit US aviation via fake Oracle SQL page.
- Tue 26 May, 13:29 UTC. SecurityWeek, its first report on the story. Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software.
- Tue 28 Jul, 08:31 UTC. Securelist, its first report on the story. Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom.
- Tue 28 Jul, 12:51 UTC. The Hacker News. NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays. This article, 14th of 18.
- Sat 1 Aug, 02:11 UTC. SecurityOnline. Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA.
- Wed 26 Aug, 18:20 UTC. The Hacker News. Nimbus Manticore adds TWOSTROKE backdoor and SSH tunneller.
- Tue 1 Sep, 13:31 UTC. The Hacker News. Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests.
- Mon 7 Sep, 10:49 UTC. SecurityOnline. Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests.
The article discusses the cybersecurity threat posed by Nimbus Manticore's deployment of NightLedger, which turns victim systems into covert relays for cyber espionage. It highlights the malware's capabilities and its implications for security frameworks, particularly in relation to the evolving landscape of cybersecurity threats. The piece stresses the need for enhanced protective measures and emphasizes the concept of zero trust in security architecture to mitigate such sophisticated attacks.
How the story developed
Quiet for 8 weekslast report 7 Sep18 articles9 outlets
18 articles from 9 outlets since 19 Sep. Quiet since 7 Sep. This was the 14th report, 312 days after the first.
- Fri 19 Sep, 16:30 UTC. The Hacker News, first report. UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware.
- Mon 22 Sep, 13:05 UTC. Check Point, its first report on the story. Nimbus Manticore Deploys New Malware Targeting Europe.
- Tue 23 Sep, 08:13 UTC. GBHackers, its first report on the story. Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack.
- Wed 24 Sep, 01:16 UTC. SecurityOnline, its first report on the story. Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe.
- Tue 18 Nov, 22:26 UTC. Dark Reading, its first report on the story. Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace.
- Wed 19 Nov, 03:20 UTC. SecurityOnline. Iranian APT UNC1549 Infiltrates Aerospace by Hijacking Trusted DLLs and Executing VDI Breakouts.
- Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
- Fri 22 May, 15:48 UTC. Check Point. Iranian hackers revive with SEO poison, fake Zoom and AI backdoor.
- Tue 26 May, 09:18 UTC. The Hacker News. Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO Poisoning.
- Tue 26 May, 09:18 UTC. Security Affairs, its first report on the story. Iranian hackers use AI malware, SEO tricks in US aviation attacks.
- Tue 26 May, 09:18 UTC. Infosecurity. Nimbus Manticore hackers hit US aviation via fake Oracle SQL page.
- Tue 26 May, 13:29 UTC. SecurityWeek, its first report on the story. Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software.
- Tue 28 Jul, 08:31 UTC. Securelist, its first report on the story. Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom.
- Tue 28 Jul, 12:51 UTC. The Hacker News. NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays. This article, 14th of 18.
- Sat 1 Aug, 02:11 UTC. SecurityOnline. Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA.
- Wed 26 Aug, 18:20 UTC. The Hacker News. Nimbus Manticore adds TWOSTROKE backdoor and SSH tunneller.
- Tue 1 Sep, 13:31 UTC. The Hacker News. Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests.
- Mon 7 Sep, 10:49 UTC. SecurityOnline. Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 18 articles as a listHide the list
- Fri 19 SepDay 01
- UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware16:30 · The Hacker News · First report
Quiet for 3 days
Mon 22 SepDay 31- Nimbus Manticore Deploys New Malware Targeting Europe13:05 · Check Point · Picked up again
- Tue 23 SepDay 41
- Wed 24 SepDay 51
- Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe01:16 · SecurityOnline
Quiet for 8 weeks
Tue 18 NovDay 601- Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace22:26 · Dark Reading · Picked up again
- Wed 19 NovDay 611
Quiet for 24 weeks
Tue 5 MayDay 2281- US defence contractors warned of nation state edge device attacks02:31 · Infosecurity · Picked up again
Quiet for 3 weeks
Fri 22 MayDay 2451- Iranian hackers revive with SEO poison, fake Zoom and AI backdoor15:48 · Check Point · Picked up again
Quiet for 4 days
Tue 26 MayDay 2494- Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO Poisoning09:18 · The Hacker News · Picked up again
- Iranian hackers use AI malware, SEO tricks in US aviation attacks09:18 · Security Affairs
- Nimbus Manticore hackers hit US aviation via fake Oracle SQL page09:18 · Infosecurity
- Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software13:29 · SecurityWeek
Quiet for 9 weeks
Tue 28 JulDay 3122- Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom08:31 · Securelist · Picked up again
- NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays12:51 · The Hacker News · This article, 14th of 18
Quiet for 4 days
Sat 1 AugDay 3161- Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA02:11 · SecurityOnline · Picked up again
Quiet for 4 weeks
Wed 26 AugDay 3411- Nimbus Manticore adds TWOSTROKE backdoor and SSH tunneller18:20 · The Hacker News · Picked up again
Quiet for 6 days
Tue 1 SepDay 3471- Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests13:31 · The Hacker News · Picked up again
Quiet for 6 days
Mon 7 SepDay 3531- Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests10:49 · SecurityOnline · Picked up again