The Iranian hacking group known as Nimbus Manticore has been linked to two newly discovered malware families, NodeRabbit and PollCat, which are capable of targeting Linux and Apple macOS systems. These are cross-platform remote access trojans developed using Node.js and JavaScript, showcasing an evolution in the group's toolset. Kaspersky, a Russian cybersecurity company, identified these malware strains, noting that NodeRabbit was first detected in Afghanistan, with further instances appearing in Egypt and Ethiopia. The group uses spear-phishing tactics on platforms like LinkedIn, disguising malware within coding challenge archives to lure developers.
Historically, Nimbus Manticore utilized malware written in C, C++, and Go, employing DLL search-order hijacking techniques. The recent shift to cross-platform tools signifies a new strategy in targeting a broader range of systems. A notable method involves presenting a ZIP file named 'Front-Technical-Challenge.zip' as part of a job opportunity, where candidates are tasked with solving a coding challenge. Unbeknownst to them, malicious code is embedded within the project instructions.
Once engaged, the NodeRabbit malware communicates with command-and-control servers hosted on Azure, executing a variety of commands such as gathering host details, executing shell commands, and managing files. Persistence across different operating systems is achieved through tailored mechanisms, including Windows Run registry keys and cron jobs for Linux. PollCat, another variant, utilizes time-limited developer assessments to deliver its payload, maintaining persistence and awaiting further instructions from the attacker.
The use of recruitment-themed lures has been a common tactic for Nimbus Manticore, similar to strategies deployed by the North Korea-linked Lazarus Group. This underscores the necessity for developers and organizations to be vigilant against such sophisticated social engineering attacks.