NewsPublished 26 May 2026

Iranian APT Targets Aviation, Software Companies With Updated Tools

Source SecurityWeek

Description

Nimbus Manticore has continued its operations during and after the US military campaign against Iran. The post Iranian APT Targets Aviation, Software Companies With Updated Tools appeared first on SecurityWeek .

Impact

The threat enables persistent remote access and control over targeted systems in aviation and software companies, allowing attackers to manipulate files and processes, exfiltrate data, and deploy further malware. The targeting of critical sectors such as aerospace and defense, including US organizations, poses risks to sensitive information and operational security. However, there is no indication of widespread exploitation or known active exploits beyond targeted intrusions. The campaigns leverage social engineering and supply chain deception rather than exploiting software vulnerabilities directly.

Defensive guidance

No vendor advisories or patches are referenced for this threat. Organizations should focus on detecting and blocking phishing campaigns, especially those involving job offer lures and trojanized installers. Monitoring for AppDomain hijacking techniques and suspicious DLL loading in .NET applications is recommended. Employing endpoint detection and response solutions capable of identifying backdoors like MiniJunk and MiniFast can aid in mitigation. Since this is an ongoing APT campaign, organizations should maintain updated threat intelligence and apply security best practices relevant to phishing and malware defense.

Summary

Nimbus Manticore (also known as Bohrium, Smoke Sandstorm, TA455, UNC1549), a subgroup of Charming Kitten (APT35) linked to Iran's IRGC, has updated its toolset and tactics in ongoing cyber espionage campaigns targeting aviation and software sectors. The group employs phishing with job offer lures and trojanized installers (e.g., Zoom installer) to deliver backdoors like MiniJunk and MiniFast. MiniFast is a 64-bit Windows PE DLL that impersonates Chrome and supports extensive remote operations including file and process manipulation, scheduled task creation, and additional payload deployment. The group uses AppDomain hijacking via malicious XML .config files to load DLLs in .NET applications. Campaigns have targeted organizations in Saudi Arabia, Australia, Europe, the Middle East, and recently the US. Nimbus Manticore also uses SEO poisoning to promote fake download sites. The group’s rapid tool development is likely aided by AI and LLM-based techniques. No specific vulnerabilities or patches are identified in the source content.

References

securityweek.com/iranian-apt-targets-aviation-software-companies-with-updated-tools/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 May 2026, 13:32 UTC

References

Community reviews