Iranian APT Uses AppDomain Hijacking in Aviation and Software Campaigns
Summary
Check Point reports that Iranian APT Nimbus Manticore used AppDomain hijacking and updated MiniJunk and MiniFast backdoors in phishing campaigns targeting aviation and software organizations, with activity extending to US-based targets.
Key points
- Check Point reports that Nimbus Manticore, also known as Bohrium, Smoke Sandstorm, TA455, and UNC1549, targeted employees at aviation and software companies in Saudi Arabia and Australia.
- The group used a trojanized .config file in a target .NET application’s directory to load a malicious DLL at launch, replacing its previously observed DLL-sideloading approach.
- One phishing campaign used a ZIP archive hosted on the OnlyOffice platform to deliver a new version of the MiniJunk backdoor.
- A separate campaign used job lures impersonating a US-based airline and a trojanized Zoom installer to deploy the MiniFast backdoor.
- MiniFast is a 64-bit Windows DLL designed for persistence and remote command execution; its reported capabilities include file manipulation, process enumeration, and deploying additional payloads.
- Check Point says the group also used a fake SQL Developer download site promoted through search-engine optimization and that recent campaigns showed increased focus on US organizations.
Article Details
- Event Type
- Reported Iranian APT intrusion campaigns targeting aviation and software organizations
- Impact
- Check Point reports that Nimbus Manticore used phishing and fraudulent hiring lures to deliver updated MiniJunk and MiniFast backdoors. The reported capabilities include persistence, remote command execution, file manipulation and exfiltration, process enumeration and termination, scheduled-task creation, and deployment of additional payloads. Campaigns targeted employees and organizations in Saudi Arabia and Australia, with a reported shift toward US-based targets.
MITRE ATT&CK
Threat Actors
Charming KittenThe article says Nimbus Manticore is believed to be a subgroup of Charming Kitten.Nimbus ManticoreCheck Point reports that this APT conducted phishing campaigns targeting aviation and software organizations, using AppDomain hijacking to deploy updated backdoors. The article says it is believed to be a subgroup of Charming Kitten and to have ties to Iran’s IRGC.RICH IONPresented parenthetically as another name for Charming Kitten; the article says Nimbus Manticore is believed to be a subgroup of that group.UNC1549Explicitly identified as an alternative name for Nimbus Manticore, which Check Point reports conducted the described intrusion campaigns.
Malware
MinibikeNimbus Manticore was previously seen targeting aerospace, aviation, and defense organizations in the Middle East and Europe with the MiniBike and MiniBus backdoors.MinibusNimbus Manticore was previously seen targeting aerospace, aviation, and defense organizations in the Middle East and Europe with the MiniBike and MiniBus backdoors.MiniFastUsing AppDomain hijacking, the infection chain led to the deployment of a new backdoor, named MiniFast.MiniJunka compressed ZIP archive from the OnlyOffice platform, leading to infections with a new version of the MiniJunk backdoor.
Products
.NETThe technique relies on a trojanized XML .config file placed in the target .NET application’s directory to load a malicious DLL at launch time.Google ChromeDeployed as a 64-bit Windows PE DLL, the backdoor impersonates a Chrome browser and was designed for long-term persistence and remote command execution.Microsoft WindowsDeployed as a 64-bit Windows PE DLL, the backdoor impersonates a Chrome browser and was designed for long-term persistence and remote command execution.ONLYOFFICEand software companies in Saudi Arabia and Australia to download a compressed ZIP archive from the OnlyOffice platform, leading to infections with a new version of the MiniJunk backdoor.SQL DeveloperIn April, Nimbus Manticore was seen using a fake SQL Developer download website to distribute the MiniFast backdoor.ZoomIn another campaign, the APT used job lures masquerading as a US-based airline, leading to a trojanized Zoom installer.
Countries
Australiaprevious campaigns, targeting employees at aviation and software companies in Saudi Arabia and Australia to download a compressed ZIP archive from the OnlyOffice platform, leading to infections with a newIranleast 2022, Nimbus Manticore is believed to be a subgroup of Charming Kitten (APT35) and to have ties with Iran’s Islamic Revolutionary Guard Corps (IRGC).IsraelWhile typical Nimbus Manticore operations have focused on the Middle East, Europe, and Africa, mainly targeting Israel and the United Arab Emirates, the fresh campaigns also revealed a shift towards US organizations.Saudi Arabiaphishing lure resembling previous campaigns, targeting employees at aviation and software companies in Saudi Arabia and Australia to download a compressed ZIP archive from the OnlyOffice platform, leading to infectionsUnited Arab EmiratesWhile typical Nimbus Manticore operations have focused on the Middle East, Europe, and Africa, mainly targeting Israel and the United Arab Emirates, the fresh campaigns also revealed a shift towards US organizations.United Statesfake job offers, and Check Point now says that the group’s activities have continued during and after the US military campaign against Iran that started in February 2026.
Industries
AerospaceNimbus Manticore was previously seen targeting aerospace, aviation, and defense organizations in the Middle East and Europe with the MiniBike and MiniBus backdoors.AviationAn Iranian APT tracked as Nimbus Manticore has adopted new tactics and updated its arsenal in new intrusions targeting aviation and software companies, Check Point reports.DefenseNimbus Manticore was previously seen targeting aerospace, aviation, and defense organizations in the Middle East and Europe with the MiniBike and MiniBus backdoors.SoftwareAn Iranian APT tracked as Nimbus Manticore has adopted new tactics and updated its arsenal in new intrusions targeting aviation and software companies, Check Point reports.