An Iranian hacking group known as Nimbus Manticore has launched a sophisticated campaign targeting Linux and macOS users. The attackers pose as recruiters offering software development jobs, using coding tests to distribute cross-platform remote access trojans (RATs). Security researchers have identified two previously undocumented malware families linked to this operation, marking a significant evolution in the group’s tactics.
The campaign leverages social engineering to infiltrate tech professionals, exploiting their interest in career opportunities. By embedding malicious payloads within seemingly legitimate coding challenges, the hackers bypass traditional security measures. Once executed, the RATs grant attackers full control over infected systems, enabling data theft, surveillance, and lateral movement within networks. The cross-platform nature of the malware allows the group to target a broader audience, including developers and organizations using open-source or macOS environments.
The new malware families, named „Dermis” and „Cannon,” are designed to operate seamlessly across Linux and macOS systems. Dermis, written in Go, supports file manipulation, process execution, and system reconnaissance. Cannon, built with Rust, focuses on stealthy persistence and encrypted communication with command-and-control servers. Both tools leverage legitimate system utilities to blend in, complicating detection efforts.
Researchers note the malware’s modular architecture, enabling rapid adaptation to different operating systems. This shift toward Linux and macOS suggests a strategic expansion beyond Windows-centric attacks. The group’s infrastructure includes domain fronting and custom encryption protocols to evade network monitoring.
The attackers create fake job postings on platforms frequented by developers, such as GitHub and LinkedIn. Candidates receive coding tests requiring them to download and run scripts or executables. These files appear harmless but contain the RAT payloads. Once executed, the malware establishes a backdoor, allowing attackers to monitor keystrokes, exfiltrate source code, or deploy additional malware.
„This method exploits trust in professional opportunities,” explains a cybersecurity analyst. „Developers are more likely to run unverified code if it’s tied to a job offer.” The campaign’s success hinges on the victims’ technical expertise, as they may overlook security warnings during the testing phase.
The campaign underscores the growing focus on targeting software developers, a critical yet vulnerable demographic. By compromising developers, attackers gain access to sensitive codebases, intellectual property, and internal systems. This aligns with broader trends of state-sponsored groups prioritizing supply chain attacks and insider threats.
Security experts urge organizations to implement strict verification protocols for third-party code and enhance endpoint monitoring. Developers are advised to scrutinize job offers and avoid executing untrusted scripts, even from seemingly credible sources.
What is the primary goal of the Nimbus Manticore campaign? The group aims to establish long-term access to target networks, enabling espionage and data theft. Their focus on developers suggests an interest in infiltrating tech-driven organizations.
How do the RATs evade detection? The malware uses legitimate system tools, custom encryption, and domain fronting to blend in. Its cross-platform design also complicates signature-based security solutions.
What steps can developers take to protect themselves? Verify job offers through official channels, avoid running unverified code, and use endpoint detection tools. Organizations should enforce code review processes and monitor for anomalous network activity.