Listen to this Post
Iranian Cyber Espionage Escalates: New NightLedger Malware Campaign Targets Governments, Telecoms, and Critical Infrastructure Across Three Continents
Introduction
State-sponsored cyber operations continue to evolve at an alarming pace, and the latest intelligence surrounding the Iranian-linked threat group known as Nimbus Manticore demonstrates just how sophisticated modern cyber espionage has become. Instead of relying on noisy ransomware attacks or destructive malware, the group focuses on long-term intelligence gathering, stealthy persistence, and covert communication channels designed to remain hidden for months or even years.
Security researchers have uncovered an entirely new attack campaign involving previously undocumented malware families that significantly expand the offensive capabilities of this advanced persistent threat (APT). The discovery highlights not only the growing technical maturity of Iranian cyber operators but also the increasing risks facing governments, telecommunications providers, aviation companies, financial institutions, and critical infrastructure organizations across the Middle East, Africa, and South Asia.
This campaign represents another reminder that geopolitical cyber conflicts continue to spill into the digital infrastructure relied upon by both governments and private organizations worldwide.
Nimbus Manticore Launches a New Cyber Espionage Operation
Researchers have attributed a fresh wave of cyber intrusions to the Iranian state-backed hacking group Nimbus Manticore, also known by several aliases including GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549.
The campaign spans multiple countries and industries, demonstrating careful victim selection rather than indiscriminate attacks. Investigators observed victims in Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, suggesting the operation was strategically planned around regional intelligence priorities instead of financial gain.
Unlike ransomware groups that seek immediate profits, Nimbus Manticore appears focused on long-term espionage, surveillance, and intelligence collection.
New Malware Arsenal Expands the
One of the most significant discoveries is the introduction of NightLedger, a previously undocumented Windows backdoor specifically engineered for covert operations.
The malware supports a broad collection of surveillance and remote administration capabilities, enabling attackers to silently maintain complete control over compromised systems while remaining difficult to detect.
NightLedger can:
Gather system and user information
Execute arbitrary commands
Launch programs remotely
Browse directory structures
Download additional payloads
Upload stolen files
Capture screenshots
Enumerate running processes
Load malicious DLLs
Copy or delete files
Terminate applications
Discover network information
Enumerate logical drives
Extract Windows diagnostic logs for reconnaissance
Together, these functions provide attackers with nearly everything needed to perform extensive cyber espionage without requiring additional malware.
DLL Side-Loading Helps Hide the Malware
Rather than executing directly, NightLedger is deployed using DLL side-loading, a well-known technique that abuses trusted Windows applications to load malicious libraries.
Because the legitimate application starts first, many security products see only a trusted executable launching, allowing the malicious DLL to operate under the cover of a legitimate process.
This technique continues to be favored by advanced threat actors because it significantly reduces the likelihood of immediate detection.
Encrypted Communications Hide the Attackers
After installation, NightLedger establishes encrypted HTTPS communications with its command-and-control infrastructure.
Once connected, operators can remotely issue commands while blending malicious traffic into normal encrypted web communications.
This communication model closely resembles another malware family previously associated with Nimbus Manticore called TWOSTROKE, indicating that the developers continue to evolve an existing malware ecosystem rather than creating entirely new frameworks from scratch.
BridgeHead and ArcBridge Create Invisible Network Tunnels
The campaign also introduces two specialized networking tools called BridgeHead and ArcBridge.
Unlike traditional malware that simply steals files, these utilities transform infected machines into covert relay nodes capable of forwarding attacker traffic through the victim’s own network.
BridgeHead operates as a SOCKS5 proxy built around WebSocket communications, allowing attackers to remotely route their tools through compromised systems without exposing their own infrastructure.
ArcBridge performs similar tunneling operations while providing flexible encrypted communications between attackers and compromised environments.
These tunneling frameworks enable operators to move laterally inside networks while appearing to originate from trusted internal systems.
Victims Span Multiple Critical Industries
Researchers identified victims across several high-value sectors.
Government organizations in Jordan and Tanzania.
Small and medium-sized businesses in Egypt.
Aviation organizations in Pakistan.
Telecommunications providers in Ethiopia.
Financial institutions in Burkina Faso.
The diversity of targets suggests intelligence collection rather than financial extortion.
Each targeted industry possesses valuable geopolitical, economic, or strategic information that could support national intelligence objectives.
Initial Access Remains Unknown
Investigators have not yet identified the precise method used to compromise victim organizations.
However, Nimbus Manticore has an extensive history of conducting carefully crafted phishing operations.
Previous campaigns relied on:
Fake recruitment offers
Job application lures
Counterfeit corporate hiring portals
Fake video conferencing invitations
Look-alike websites
Malicious archive downloads hosted on third-party file-sharing services
These techniques exploit human trust rather than software vulnerabilities, making employee awareness a critical layer of defense.
BridgeHead Turns Victims into Secret Relay Servers
One particularly dangerous capability is
Instead of sending attack traffic directly from the operator’s infrastructure, every command is forwarded through the victim’s infected computer.
This means that network connections appear to originate from inside the compromised organization itself.
Such architecture makes attribution significantly more difficult while helping attackers bypass firewalls, intrusion detection systems, and geographic filtering.
It also complicates forensic investigations because malicious activity appears to come from legitimate internal devices.
Tunneling Technology Continues to Evolve
BridgeHead and ArcBridge are not isolated developments.
Nimbus Manticore has previously deployed custom tunneling utilities including LIGHTRAIL and POLLBLEND.
The continued investment in bespoke networking frameworks demonstrates that maintaining covert access remains one of the group’s highest operational priorities.
Rather than depending on commodity malware, the attackers continue building specialized infrastructure optimized for stealth and persistence.
Another Iranian Campaign Uses Microsoft 365 as Command Infrastructure
The disclosure follows another major discovery involving an Iranian cyber operation.
Researchers recently identified HOLLOWGRAPH, malware associated with the Cavern Manticore framework.
Instead of communicating with suspicious external servers, HOLLOWGRAPH abuses the Microsoft Graph API by transforming a compromised Microsoft 365 calendar into a hidden command-and-control platform.
Attackers place encrypted instructions inside calendar events while stolen information is uploaded back into future calendar entries.
To avoid attracting attention, every malicious calendar event is scheduled decades into the future, specifically May 13, 2050.
This creative abuse of trusted cloud services demonstrates how modern threat actors increasingly leverage legitimate platforms to conceal malicious communications.
What Undercode Say:
The latest Nimbus Manticore campaign reflects a mature intelligence operation rather than a conventional malware outbreak.
Several characteristics stand out immediately.
First, the malware focuses heavily on persistence instead of destruction.
Second, the attackers invest considerable effort into covert communications.
Third, every component appears modular, allowing operators to deploy only the tools required for each mission.
NightLedger itself is not revolutionary because many backdoors provide similar command execution features.
What makes it dangerous is how it integrates into a broader espionage ecosystem.
BridgeHead and ArcBridge significantly increase operational flexibility by allowing attackers to pivot through compromised hosts without exposing their own infrastructure.
This architecture dramatically complicates incident response.
Many organizations still monitor outbound connections but rarely inspect encrypted WebSocket traffic in depth.
That gap creates opportunities for stealthy communications.
The continued use of DLL side-loading also demonstrates that trusted applications remain attractive attack vectors.
Organizations often whitelist legitimate software while paying less attention to dynamically loaded libraries.
Another interesting observation is victim selection.
Governments.
Telecommunications.
Financial institutions.
Transportation.
These sectors represent intelligence priorities rather than random financial targets.
The campaign also illustrates how phishing remains highly effective despite years of awareness programs.
Advanced social engineering continues to outperform sophisticated exploitation in many real-world attacks.
Security teams should also recognize that encrypted HTTPS traffic alone cannot be trusted.
Legitimate encryption protects both users and attackers.
Behavioral analytics therefore become increasingly important.
Network segmentation can significantly reduce lateral movement.
Application allow-listing helps detect unauthorized DLL loading.
Endpoint Detection and Response (EDR) solutions should monitor unusual parent-child process relationships.
Threat hunting should include WebSocket traffic analysis.
Organizations should monitor outbound connections to unfamiliar infrastructure.
Memory forensics remains valuable because many espionage tools intentionally minimize disk artifacts.
Regular log reviews may reveal abnormal authentication patterns before data theft becomes extensive.
Cloud monitoring deserves equal attention because adversaries increasingly abuse trusted SaaS platforms.
Microsoft Graph API abuse demonstrates that traditional perimeter defenses alone are no longer sufficient.
Organizations should combine identity protection, endpoint visibility, network telemetry, and threat intelligence into a unified detection strategy.
Ultimately, this campaign reinforces a growing trend in global cyber operations.
Modern espionage is becoming quieter, more modular, more cloud-aware, and far more difficult to detect than traditional malware campaigns.
Defenders must evolve just as quickly.
Deep Analysis
The following commands can assist incident responders and defenders when investigating indicators similar to this campaign.
Check active network connections
netstat -ano ss -tunap
Identify suspicious DLL loading
tasklist /m
Get-Process
Review scheduled tasks
schtasks /query /fo LIST /v
Examine running services
Get-Service sc query
Inspect startup persistence
reg query HKCUSoftwareMicrosoftWindowsCurrentVersionRun
reg query HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Monitor network connections
tcpdump -i any
Search Windows Event Logs
Get-WinEvent -LogName Security
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational
Verify suspicious processes
Get-Process | Sort CPU -Descending
Enumerate loaded modules
Get-Process | Select-Object ProcessName,Id
Detect unusual outbound HTTPS activity
sudo tshark -i any
✅ Security researchers identified Nimbus Manticore using new malware families including NightLedger, BridgeHead, and ArcBridge during recent cyber espionage operations.
✅ The campaign targeted organizations across the Middle East, Africa, and South Asia, with victims spanning government, telecommunications, aviation, financial services, and business sectors, indicating strategic intelligence collection rather than opportunistic attacks.
✅ The reported malware capabilities, including DLL side-loading, HTTPS command-and-control communications, WebSocket tunneling, and Microsoft Graph API abuse in related Iranian operations, are technically plausible techniques that align with previously documented advanced persistent threat behaviors.
Prediction
(-1) Negative Prediction
Continued geopolitical tensions are likely to drive further investment in custom malware frameworks and stealth-focused espionage operations.
WebSocket tunneling and legitimate cloud service abuse will become increasingly common because they blend into normal enterprise traffic.
Organizations that rely primarily on signature-based detection will experience greater difficulty identifying future generations of modular espionage malware.
Critical infrastructure operators should expect more highly targeted phishing campaigns designed to establish long-term covert access rather than immediate disruption.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
