Nimbus Manticore, an Iranian state-backed hacking group tracked under multiple aliases including GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549, has deployed a previously undocumented Windows backdoor called NightLedger alongside two custom WebSocket tunnelers in a campaign targeting organizations across the Middle East, Africa, and South Asia. The new tooling extends the group’s persistent espionage capability and introduces a relay infrastructure that complicates defender attribution by routing traffic through victim machines.
NightLedger: Capabilities of the Previously Undocumented Backdoor
NightLedger is a Windows backdoor with four documented capabilities: file exfiltration, command execution, system information gathering, and maintaining persistent access through covert command-and-control channels. The combination of remote execution and file access gives operators broad reach into any compromised system, while the persistence mechanism ensures the foothold survives standard defenses such as process termination or system restarts.
The backdoor’s C2 architecture relies on stealth rather than raw capability — the covert channels are designed to blend into normal network traffic patterns, making detection dependent on behavioral analysis rather than signature-based blocking. This approach is consistent with Iranian APT tooling documented in prior Nimbus Manticore campaigns, where operational longevity takes precedence over speed of exploitation.
The WebSocket Tunnelers: Victim Machines as Covert Relay Nodes
The more tactically significant new addition is the pair of custom WebSocket tunnelers deployed alongside NightLedger. These tools convert compromised victim machines into relay nodes, routing the group’s traffic through systems inside the target network rather than directly from external attacker infrastructure. The technique serves two functions: it makes the traffic appear to originate from a trusted internal host rather than a known-malicious IP address, and it introduces an intermediate hop that makes network-level attribution harder for defenders analyzing outbound connections.
WebSocket-based tunneling is a well-documented evasion technique because WebSocket traffic is indistinguishable from ordinary HTTP upgrades at the protocol level and is permitted through most enterprise web proxies. Detecting its use as a covert relay requires monitoring for unusual outbound WebSocket session durations, unexpected destination IPs for WebSocket connections, or data volume anomalies inconsistent with the declared application.
Three-Region Targeting and the Espionage Mandate
The campaign’s geographic scope — Middle East, Africa, and South Asia — is consistent with Iranian state intelligence priorities. Nimbus Manticore has been active for several years and is considered a persistent Iranian cyber espionage threat, with operations directed at organizations in regions of geopolitical significance to Tehran. The breadth of the targeting pattern, spanning three distinct regions simultaneously, suggests a broad reconnaissance or intelligence-collection mandate rather than a narrowly scoped operational objective.
Nimbus Manticore’s Position in the Iranian Threat Actor Ecosystem
Nimbus Manticore is tracked under multiple names by different security vendors, reflecting the group’s documented history of operational activity and the parallel investigation timelines across the research community. The aliases — GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549 — represent the same attributed threat actor. This consolidation matters for defenders: threat intelligence on any of these aliases applies to the same underlying infrastructure and tradecraft, including the newly disclosed NightLedger tooling.
The introduction of new, previously undocumented malware is a significant data point about Nimbus Manticore’s operational posture. Groups that invest in custom tooling rather than relying on off-the-shelf frameworks are typically more sophisticated, more persistent, and harder to detect through common indicator-based defenses. NightLedger’s appearance suggests the group is developing dedicated capabilities for this campaign series rather than reusing commodity tools that may already be detected by endpoint security products.
Detection and Defense Considerations
No vendor-specific patch addresses NightLedger, which is not a software vulnerability but a post-compromise implant. Detection depends on endpoint behavioral monitoring — specifically, identifying processes on Windows systems that perform file exfiltration, command execution from unusual parent processes, or persistent connections to external hosts over covert channels. Network monitoring for unusual WebSocket tunneling sessions — particularly those with extended duration or unexpected data volumes — can surface the tunneler component.
Organizations in the campaign’s target geographies — specifically those in Middle East, African, and South Asian sectors where Iranian intelligence collection is historically active — should review endpoint telemetry for NightLedger indicators and audit outbound WebSocket traffic for anomalous relay patterns consistent with the described tunneler behavior. Network segmentation and tight egress filtering reduce the operational effectiveness of WebSocket-based covert relay infrastructure by limiting which internal hosts can establish outbound connections.
