Iran-Linked Hackers Target Europe With New Malware

An Iran-linked cyber-espionage group known as Nimbus Manticore has expanded its operations beyond the Middle East to target Western Europe’s critical infrastructure, with Denmark, Portugal and Sweden named as targets for defense manufacturing, telecommunications and aviation sectors.

According to Check Point Software, Nimbus Manticore is deploying an improved malware toolkit centred on MiniJunk, a backdoor, and MiniBrowse, a browser credential stealer, both aimed at gaining persistent access and exfiltrating data via multiple HTTPS-based C2s. The campaign begins with highly tailored spear-phishing emails that impersonate HR recruiters and direct victims to fake job pages linked to well-known organisations, followed by a multi-stage sideloading process to download the malware.

The actors have been signing their malware with SSL[.]com certificates since at least May 2025, a technique used to blend in with legitimate traffic, Check Point noted. Nimbus Manticore is linked to the Iranian Revolutionary Guard Corps by some researchers, and threats attributed to UNC1549 are cited in the broader context of Iran-aligned groups increasingly targeting outside the Middle East. The report was published on 22 September 2025. according to Check Point Software