Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays

The cybersecurity landscape remains volatile as state-sponsored actors refine their tradecraft to evade modern defenses. Recently, the Iranian-aligned threat group known as Nimbus Manticore has re-emerged with a sophisticated toolkit designed to infiltrate and maintain persistence within targeted networks. This campaign, which strikes critical entities across the Middle East, Africa, and South Asia, underscores a dangerous evolution in espionage tactics. By leveraging a previously unknown Windows backdoor and specialized tunneling protocols, the group is effectively hijacking victim infrastructure to serve their operational needs.

Tracked by the industry under various aliases such as GalaxyGato, Mirage Kitten, and Smoke Sandstorm, this threat actor has been attributed to a fresh wave of intrusions centered on a novel malware strain designated NightLedger. This backdoor is deployed in conjunction with two custom WebSocket tunnelers, a technical choice that signals a deliberate focus on bypassing network segmentation. The attackers’ primary strategy involves turning compromised systems into covert relays. By transforming victim machines into intermediate nodes, the operators can route malicious command and control traffic through these assets. This method effectively obfuscates the true source of the attack, creating a layer of insulation that makes attribution and disruption significantly more difficult for incident responders.

The implications for security teams are profound, as the use of WebSocket tunnelers presents a specific challenge for network monitoring. Because WebSocket traffic is often permitted through corporate firewalls to support legitimate web applications, it provides a ready-made cover for malicious data transmission. When a system is converted into a relay, it may show signs of unusual outbound connections or data flows that closely resemble normal business activity. Defenders relying solely on signature-based detection are likely to miss these subtle indicators. Furthermore, the misuse of internal systems as relays can lead to bandwidth degradation and reputational damage if the victim’s IP addresses are flagged for malicious activity originating from the attackers. To counter this threat, organizations must adopt a more defensive posture that includes deep packet inspection and rigorous behavioral analysis to spot anomalies in WebSocket usage and unauthorized proxying activity.

Ultimately, the deployment of NightLedger by Nimbus Manticore serves as a critical reminder that nation-state groups continue to innovate rapidly. The ability to turn victim systems into operational infrastructure highlights the need for continuous vigilance and the adoption of advanced detection methodologies. As attackers increasingly abuse legitimate protocols to hide their tracks, security professionals must look beyond surface-level indicators. Understanding the tactics of groups like Nimbus Manticore is essential for hardening defenses against the next generation of stealthy cyberespionage campaigns.