TLDR Tech / InfoSec
Iran's Nimbus Manticore Used Trojanized Zoom Installers Against US Firms
IRGC-linked Nimbus Manticore (UNC1549) ran a campaign from February to April that paired AppDomain hijacking, where a malicious Setup.exe.config sits beside a signed Microsoft Setup.exe, with trojanized Zoom installers (Zoom_cm.exe) to deploy the MiniJunk and MiniFast backdoors while hijacking the legitimate ZoomUpdateTaskUser scheduled task for persistence. The group escalated tradecraft mid-conflict, building AI-assisted code that gave full cmd.exe remote control over Chrome-impersonating traffic, then abandoned email lures for SEO poisoning that pushed a fake getsqldeveloper[.]com to the top of Bing and DuckDuckGo. Defenders should hunt for .config files paired with signed binaries, audit scheduled tasks for tampering, and watch for download activity from typosquatted software-download domains.
Read the full story