Nimbus Manticore Deploys New Malware Targeting Europe

Nimbus Manticore, a mature Iran-nexus APT tracked by Check Point Research as UNC1549 or Smoke Sandstorm, has been operating a long‑running campaign targeting defence manufacturing, telecommunications and aviation, aligned with IRGC priorities. The group has recently intensified its focus on Western Europe, notably Denmark, Sweden and Portugal, impersonating aerospace, defence and telecom organisations in spear‑phishing attempts.

Check Point Research describes a multi‑stage infection chain centred on tailored spear‑phishing from alleged HR recruiters directing victims to fake career portals, with unique URLs and credentials issued to each target for tracking and access control. The backdoor, dubbed MiniJunk, is delivered via a multi‑stage sideloading technique that hijacks DLL loading paths, while MiniBrowse acts as a stealer for Chrome and Edge credentials.

The operators employ heavy obfuscation and code signing to lower detection rates, and maintain multiple C2 servers (between three and five) for redundancy, with infrastructure that includes Cloudflare and Azure App Service. according to Check Point Research, MiniJunk has also begun using SSL[.]com for signing, and the campaign’s European operations appear to share a common code base with a separate cluster that includes dxgi.dll and a less obfuscated variant.