Nimbus Manticore Deploys New Malware Targeting Europe

The Iranian threat actor Nimbus Manticore has expanded its operations, targeting defense, telecommunications, and aviation sectors in Western Europe. The group uses sophisticated spear-phishing techniques, impersonating HR recruiters to lure victims to fake career portals. Their toolset includes the MiniJunk backdoor and MiniBrowse stealer, which have evolved to employ advanced evasion techniques like multi-stage DLL sideloading, heavy obfuscation, and code signing. The malware infrastructure leverages Azure App Services for resilient command and control. Nimbus Manticore's recent activities demonstrate increased focus on stealth, operational security, and expanding their targeting to align with Iranian strategic priorities.

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• NeedyMantis: Unpacking a post-compromise malware family used in targeted operationsMalware2026-09-28
• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03
• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02