Nimbus Manticore APT Uses Fake Job Portal for Custom Malware Attacks

Key Takeaways

• The state-sponsored APT group Nimbus Manticore (also known as UNC1549 and Smoke Sandstorm) is deploying custom malware through an elaborate fake recruitment campaign called “Abuses Recruitment.”
• The campaign targets professionals in the aerospace and defense sectors across the Middle East and Europe.
• Attackers leverage social engineering via LinkedIn and a sophisticated multi-stage malware delivery chain, including AppDomain hijacking, to install persistent implants.
• The custom malware utilizes legitimate Microsoft components and trusted Azure infrastructure to evade detection, while employing increased code obfuscation.

A sophisticated new campaign, dubbed “Abuses Recruitment,” is seeing the state-linked advanced persistent threat (APT) group Nimbus Manticore deliver custom malware through an intricately designed fake job portal. This operation targets unsuspecting victims, aiming to compromise their systems with advanced, difficult-to-detect payloads.

Nimbus Manticore, also tracked by security researchers as UNC1549 and Smoke Sandstorm, has a well-documented history of targeting professionals within the aerospace and defense industries across the Middle East and Europe. This latest campaign demonstrates a notable increase in the group’s technical prowess, seamlessly merging social engineering tactics with a complex, multi-stage malware delivery process.

The Elaborate Recruitment Lure

The attack chain commences with the threat actors establishing contact with potential victims on LinkedIn, utilizing a meticulously crafted, convincing fake recruiter profile. This persona impersonated a talent scout for Ebix, a legitimate company operating in the insurance and banking technology sectors, and sweetened the deal with an enticing salary offer of $200,000 to enhance credibility.

Prospective candidates were then redirected to a highly polished, fraudulent hiring portal located at ebix[.]recruitment-flow[.]com. Crucially, this portal required login credentials before any malicious content was presented to the user, adding another layer of legitimacy to the ruse.

Analysts at Nextron uncovered this sophisticated sideloading infection chain during a recent incident response engagement. Based on their findings, Nextron confidently attributed the activity to Nimbus Manticore. In a report shared with Cyber Security News (CSN), Nextron highlighted that while the specific tools and payloads used by the group may vary between operations, their core tradecraft remains remarkably consistent across campaigns. The report further detailed how the operators have refined their techniques while maintaining their underlying attack patterns.

Upon successfully logging into the fake portal, victims were prompted to download what appeared to be a two-factor authentication (2FA) application, ostensibly for enhanced security during the hiring process. This application was delivered as a ZIP archive containing the actual malware. The entire sequence was meticulously designed to appear routine, systematically lowering the victim’s guard before the malicious payload could execute.

Nimbus Manticore APT Abuses Fake Recruitment Portal

The ZIP archive contained a renamed Microsoft Visual Studio component, “setup.exe,” which carried a legitimate Microsoft digital signature. The attackers strategically altered its configuration file to manipulate the .NET runtime, forcing it to load a malicious library named “TOTPGuard.dll” instead of proceeding with normal execution. This technique, known as AppDomain hijacking, ensured that the initial process appeared benign, making it unlikely to trigger standard security alerts.

After the victim executed “setup.exe,” they were presented with a convincing fake Ebix interface prompting for a secret key, followed by a fully functional one-time password generator. The application behaved exactly as a legitimate 2FA tool would, significantly reducing the likelihood of victims suspecting any compromise. Covertly, the malware decrypted an embedded payload using hardcoded AES keys and dropped it to disk within the user’s AppData folder.

Persistence, C2, and Evasion Tactics

To maintain persistence on the compromised machine, the malware established a scheduled task named “BackupCheck,” configured to run every time the user logged in. The primary payload, stored as “main.dll,” communicated with command-and-control (C2) servers hosted on Microsoft Azure. Utilizing a trusted cloud platform like Azure allows the C2 traffic to blend seamlessly into normal network activity within many organizations. The C2 domains themselves were crafted with benign-sounding names that aligned with the recruitment theme, making them easy to overlook during superficial network traffic analysis.

The native implant also incorporated anti-analysis checks, including verifying its own process name and actively searching for debuggers by examining the Process Environment Block. The threat actors have evidently increased the level of code obfuscation significantly in this campaign, likely in response to previous public reporting from other security vendors. Despite these added layers of complexity, the core functionalities, such as data exfiltration and C2 communication, remained consistent with previously documented Nimbus Manticore behavior.

What You Should Do

• Restrict Newly Registered Domains: Implement network policies to block or restrict access to newly registered domains, especially for departments like HR, finance, and legal, which are frequently targeted by social engineering.
• Utilize Application Whitelisting: Employ Windows AppLocker or similar application control solutions to prevent the execution of unauthorized code from user-writable directories, such as AppData and Temp, where staged payloads are often dropped.
• Enhance Security Awareness Training: Expand security awareness programs beyond traditional email-based phishing to include social media platforms (like LinkedIn) and job portals, as these are increasingly exploited by APT groups for initial access. Educate employees on verifying recruiter legitimacy and scrutinizing unexpected software downloads during recruitment processes.
• Monitor C2 Traffic: Implement robust network monitoring to detect suspicious outbound connections, particularly to cloud services like Azure, and scrutinize domains that appear benign but may be associated with known threat actor infrastructure.
• Implement Multi-Factor Authentication (MFA): While this attack used a fake 2FA app, robust, hardware-backed MFA should be mandatory for all corporate accounts to prevent credential compromise from leading to full account takeover.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.