Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe

Check Point Research (CPR) has published new findings on Nimbus Manticore, an Iranian state-aligned APT group overlapping with UNC1549, Smoke Sandstorm, and the Dream Job operations, with the campaign active since early 2025 and intensifying its focus on Western Europe. According to Check Point Research, Nimbus Manticore’s activity now centres on Denmark, Sweden, and Portugal, with the threat actor impersonating local and global aerospace, defence manufacturing, and telecommunications organisations.

The group continues to rely on highly tailored spear-phishing, directing victims to fake career portals where a unique URL and credentials are issued to each target for tracking and controlled access. Once logged in, targets are prompted to download a malicious archive that triggers the infection chain, culminating in the MiniJunk backdoor and a separate MiniBrowse stealer injected into Chrome and Edge processes.

The malware uses obfuscated, multi-layer techniques and signs binaries to reduce detection, while employing multiple C2 servers and reportedly non-encrypted traffic to complicate static analysis. Recent operations show a pivot towards European targets such as satellite providers, defence contractors, and airlines, aligning with Iran’s long-term intelligence-gathering objectives.