Emerging Malware Threats from Iranian Hacking Collective Nimbus Manticore
The Iranian hacking consortium known as Nimbus Manticore has recently been linked to two novel malware families that underscore the persistent enhancement of its cyber arsenal.
This evolution is likely expanding the group’s sophistication in targeting Linux and Apple macOS systems utilizing cross-platform remote access trojans (RATs) crafted with Node.js and JavaScript.
Cybersecurity firm Kaspersky, based in Russia, has designated the newly identified malware variants as NodeRabbit and PollCat.
The inaugural detection of NodeRabbit occurred on a system in Afghanistan, followed by additional sightings on machines situated in Egypt and Ethiopia.
According to Kaspersky security expert Omar Amin, “NodeRabbit is disseminated through spear-phishing tactics on LinkedIn and other career-platforms, cloaked within trojanized coding challenge archives.”
He further noted, “Similar to NodeRabbit, PollCat is another cross-platform RAT, yet it is constructed with obfuscated JavaScript and also transmitted via tainted coding challenge archives.”
Historically, Nimbus Manticore has relied predominantly on malware written in C, C++, and Go. These approaches utilized DLL search order hijacking techniques for deployment.
However, the recent revelations indicate the group’s strategic pivot towards cross-platform tools to fulfill their nefarious aims.
This development coincides with a rapid augmentation of the hacking collective’s malware inventory over the preceding months, which includes:
- A Windows backdoor titled NightLedger
- Two custom WebSocket tunnelers named BridgeHead and ArcBridge
- A reverse SSH tunneling tool
- A backdoor exhibiting similarities to TWOSTROKE
The initial suspicious activity observed on the Afghanistan-based system originated from a ZIP file labeled “Front-Technical-Challenge.zip,” allegedly distributed as part of a purported engineering job opportunity.
The threat actors masqueraded as talent acquisition specialists at a prominent technology firm, enticing a software engineer to undertake a technical task.
Notably, Nimbus Manticore is also recognized by the alias Iranian Dream Job for its exploitation of recruitment-themed ruses to ensnare potential victims into compromising their own computers, echoing tactics historically employed by the North Korea-associated Lazarus Group.
The challenged archive encompasses source code for a task management application named Taskflow, instructing candidates to “locate and rectify all bugs in the frontend code” within a three-hour timeframe, emphasizing a ban on using artificial intelligence tools.
Intriguingly, the guidelines explicitly instruct candidates against modifying the application’s server component (“server.js”), asserting its perfection. Yet, it is within this file that the nefarious code is concealed.
Kaspersky elucidated: The opening line of server.js imports a trojanized npm package labeled colorized_terminal, version 2.1.0.
The attackers included this package directly within the challenge archive’s node_modules directory, bypassing publication on the npm registry. Upon import, the package silently initializes an implant from node_modules/.cache/.320697f1/index.js as a detached background process.
The implant in question, NodeRabbit, establishes communication with one of three Azure-hosted command-and-control (C2) addresses (“plugplay.azurewebsites[.]net,” “rgbteller.azurewebsites[.]net,” and “wslwebui.azurewebsites[.]net”) via three distinct API endpoints:
- /api/rabbit/checkin, to register agent and host data
- /api/rabbit/task, to retrieve executable commands
- /api/rabbit/result, to relay task outcomes
The malware is capable of executing eleven commands that empower it to collect host details, enumerate running processes, execute arbitrary shell commands, browse directories, fetch files in segments and transmit Base64-encoded data, decode such text, remove files or execute recursive deletions, create directories, and survey IP addresses, MAC addresses, DNS settings, and modify beacon frequency.
Noteworthy is NodeRabbit’s ability to inscribe a Base64-encoded Node.js script onto a randomly named “.tmp” file, execute it, and erase it, thereby concealing traces of malevolent activity.
Kaspersky also identified two additional variants of NodeRabbit sharing the same code lineage, each extracted from Egypt and Ethiopia:
- The second variant employs a different trojanized npm package named pretty-log (version 2.1.0) instead of colorized_terminal, with built-in mechanisms to halt execution if detected in an analysis environment and partial corporate proxy support.
- The third variant, relying on the pretty-log npm package, utilizes an alternative suite of API endpoints for execution:
- /sdk/v2/ready
- /sdk/v2/config
- /sdk/v2/events
Persistence of these malwares is achieved based on the operating system in use: through a Windows Run registry key on Windows, a cron job for Linux, and a launch agent for macOS.
The persistence strategy either imitates a Microsoft Edge browser update (first variant) or Intel’s Driver & Support Assistant (second variant).
Conversely, the third variant does not masquerade as legitimate software yet also considers the Windows Subsystem for Linux (WSL) to establish a daily 10 a.m.
Windows task which activates a Visual Basic Script file via wscript.exe and “wsl.exe.” Additionally, it encompasses twelve new commands designed to:
- Enumerate accessible Windows and WSL-mounted drives
- Execute processes
- Terminate processes using PID or by image name
- Substitute the active C2 server and preserve the new configuration
- Disclose the current C2 server
- Extract account details from Outlook OST and PST files
- Attempt to install a fake VS Code extension dubbed “GitHub Copilot Helper” for enhanced persistence
- Verify persistence indicators across VS Code, scheduled tasks, and Run-parameters
- Remove the counterfeit extension
- Inspect recent and common developer paths for Git repositories
- Embed a launcher into a repository’s Git hooks for added persistence
- Eliminate the designated Git-hook launcher
Nimbus Manticore has also been noted deploying programming challenge lures such as (“RankChallenge-react-6uJSX3-main.zip”) disseminated through time-sensitive developer evaluations to install PollCat.
Kaspersky remarked, “Although the visible exercise isn’t a security CTF, project nomenclature employs CTF terminology within various contexts.
The root package is termed ctf-server, the backend indicates CTF server operations, the frontend utilizes several ctf-* storage keys, and the tutorial refers to path/to/ctf.”
Included in the archive is a PDF tutorial advising targets to click Continue, input an attacker-generated six-digit OTP refreshed every thirty seconds, and complete the challenge within a one-hour framework.
The compressed timeline to activate the assessment likely seeks to cultivate an artificial sense of urgency, pressuring targets to engage with the project hastily, thereby heightening the chances of a successful infection.
Despite the one-hour time limit, PollCat operates independently of the OTP authentication process, remaining unaffected by the success or failure of OTP validation.
A failed validation obstructs access to protected challenge functionalities, while successful OTP validation generates a JWT and initiates an additional PollCat instance.
For persistence, this malware forms a daily scheduled task across Windows, Linux, or macOS, subsequently establishing a connection to a C2 server to relay basic host information and await further directives. PollCat supports 22 commands and communicates through seven API endpoints:
- /beacon, for client registration and to acquire a socketId
- /gate/hello, to relay host, user, domain, operating system data, and current privilege level
- /gate/fetch?token=, to solicit commands
- /gate/submit, to give a Base64-encoded command-result structure
- /vault/, to retrieve a hosted file and install it on the victim’s device
- /vault/push, to upload a local file or file fragment to the C2
- /gate/track, to report upload progress
The commands encompass typical backdoor functionalities, permitting operators to execute file actions, run shell commands, upload/download files, execute JavaScript, load DLLs, create or extract ZIP archives, and enumerate processes, drives, volumes, or mounted points.
Three commands—WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST—currently remain unimplemented.
PollCat is also designed to search for directories corresponding to 24 hard-coded strings linked to software and security vendors including Google, Microsoft, Palo Alto Networks, among others.
Upon discovering a matching directory, the malware inventories the folder’s root contents, though it avoids recursive exploration of the product’s directory. The results are relayed in JSON format to the “/api/system-details/result” endpoint.
The affiliation of this activity with Nimbus Manticore arises from the congruence in structure, command retrieval techniques, beacon intervals, and command sets shared by PollCat and MiniFast (also known as MiniUpdate or Retrograde), a backdoor previously linked to the group, in conjunction with the employment of Azure Websites and Cloudflare-backed domains for command-and-control operations.
Kaspersky concluded that the transition to cross-platform scripting grants operators a singular codebase operational across Windows, Linux, and macOS, crafting payloads that seamlessly integrate into developer workstations.
Conversely, the delivery mechanism persists in alignment with Mirage Kitten’s established tradecraft: leveraging recruiter personas on LinkedIn to target critical sectors spanning the Middle East and Africa for cyber espionage endeavors.
Source link: Thehackernews.com.
