Iranian APT Uses SEO Poisoning to Deliver Fake SQL Developer Malware

Key Takeaways

• An Iranian APT group, Nimbus Manticore (UNC1549), has adopted SEO poisoning to distribute a new backdoor, MiniFast.
• The group created a convincing fake website impersonating Oracle’s SQL Developer download page, which ranked highly on search engines.
• Victims who downloaded the fake software inadvertently installed the MiniFast backdoor, granting attackers long-term remote access.
• The malware appears to have been developed with the assistance of AI tools, indicating a shift in the group’s operational tactics.

Iranian APT Leverages SEO Poisoning for Malware Distribution

An Iranian advanced persistent threat (APT) group, identified as Nimbus Manticore (also known as UNC1549), has significantly evolved its attack methodology. Previously reliant on targeted phishing emails, the group is now employing sophisticated search engine optimization (SEO) poisoning to disseminate its malicious payloads. This tactical shift was detailed in a recent report by Check Point Research.

The APT group engineered a deceptive website designed to mimic a legitimate download portal for database software. By manipulating search engine algorithms, the attackers successfully elevated this fraudulent site’s visibility, causing it to appear prominently in search results. Unsuspecting users searching for the SQL Developer tool were thus led to download a weaponized installer, unknowingly compromising their systems with a persistent backdoor.

Nimbus Manticore: A Shifting Threat Landscape

Nimbus Manticore, an entity operating under the command of Iran’s Islamic Revolutionary Guard Corps (IRGC), has a documented history of targeting professionals in the software and aviation sectors. Their prior campaigns typically involved career-themed phishing lures. The current operational wave, however, marks a notable departure, as researchers had not previously observed this group utilizing search engine manipulation as a primary delivery mechanism.

Check Point Research analysts detected this activity across three distinct waves between February and April 2026. This period notably coincided with and followed “Operation Epic Fury,” a US military campaign against Iran. According to a report shared with Cyber Security News (CSN), Check Point highlighted the group’s demonstrated capacity for rapid tool adaptation and sustained infrastructure maintenance, even amidst active wartime conditions.

The SQL Developer Campaign

The most recent phase of this operation, dubbed the “SQL Developer” campaign, commenced in April 2026. The attackers registered the domain getsqldeveloper[.]com, meticulously crafting it to resemble an authentic download page for Oracle’s widely used database management tool, SQL Developer. Individuals who navigated to this counterfeit site and attempted to download the software were instead served a malicious installer. This installer covertly deployed a newly identified backdoor dubbed MiniFast onto their systems.

The success of this SEO poisoning campaign was not limited to a single fake site. The attackers registered dozens of ancillary domains, all configured to link back to the primary malicious page. This strategy effectively boosted the fake site’s search engine ranking through link-based signals. Furthermore, the site was saturated with repeated phrases such as “Download SQL Developer” to enhance its visibility in search results. At the time of analysis, the fraudulent domain was observed ranking near the top of Bing and DuckDuckGo results for the search term “sql developer.”

MiniFast Backdoor and AI-Assisted Development

The MiniFast backdoor is a 64-bit Windows DLL designed to provide comprehensive, long-term remote access to compromised systems. It establishes communication with attacker-controlled servers via structured HTTP endpoints, camouflaging its traffic by impersonating a Chrome browser through a hardcoded User-Agent string. Operators wielding MiniFast gain capabilities such as executing shell commands, managing files, enumerating running processes, exfiltrating data, and attempting privilege escalation.

Intriguingly, Check Point researchers also uncovered compelling evidence suggesting the malware’s development was aided by artificial intelligence tools. The MiniFast codebase exhibited characteristics commonly found in AI-generated code, including excessive error handling, verbose function names, and highly detailed debug messages. This suggests that Nimbus Manticore may be leveraging large language models to accelerate their development cycles and deploy updated tools more quickly, particularly under the pressures of wartime operations.

What You Should Do

• Verify Download Sources: Always download software directly from the official vendor’s website. Do not rely solely on search engine results, as SEO poisoning can promote malicious sites.
• Monitor for Anomalies: Security teams should actively monitor for any unexpected changes to scheduled tasks and unusual DLL loading behaviors, which are key indicators of this group’s attack methods.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to suspicious activities, including process injection, unauthorized file modifications, and unusual network communications.
• Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of downloading software from unverified sources and the importance of scrutinizing website URLs.
• Review IoCs: Integrate the provided Indicators of Compromise (IoCs) into your threat intelligence platforms (e.g., MISP, VirusTotal, SIEM) for proactive detection and blocking.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.