Nimbus Manticore Uses MiniFast in Campaigns Targeting Aviation and Software Organizations
Summary
Check Point says IRGC-affiliated Nimbus Manticore (UNC1549) used phishing, a trojanized Zoom installer and SEO-poisoned SQL Developer site to deliver MiniFast. Researchers detail its AppDomain hijacking, scheduled-task persistence and HTTP C2.
Key points
- Check Point reports three waves of Nimbus Manticore activity, with recent targeting of aviation and software organizations in the United States, Europe and the Middle East.
- Delivery methods included career-themed and meeting-invitation phishing, a trojanized Zoom installer, and a fake SQL Developer download site promoted through SEO poisoning.
- The infection chains used AppDomain hijacking: malicious configuration files directed trusted .NET applications to load attacker-controlled DLLs.
- The Zoom-based chain hijacked a scheduled task created by the legitimate installer for persistence; MiniFast can also create a task named WindowsSecurityUpdate.
- The newly identified MiniFast backdoor replaces the previously used MiniJunk family and supports command execution, file operations, process management, DLL loading and persistence.
- MiniFast uses HTTP-based C2, with JSON exchanges for parts of its communication and Base64-encoded tasking and results.
- Researchers assess that AI-assisted development may have contributed to the malware, citing code structure, naming patterns and error-handling characteristics.
Article Details
- Attack Vectors
- Career-themed phishing and fake meeting invitations led targets to malicious archives or installers.
- SEO poisoning promoted a fake SQL Developer download site that delivered MiniFast.
- Trojanized Zoom and Microsoft-signed executables used AppDomain Hijacking to load malicious DLLs.
- A malicious loader hijacked a scheduled task created by the Zoom installer; MiniFast could also create a WindowsSecurityUpdate task.
- MiniFast used HTTP-based C2 for tasking, command execution, file downloads, and file uploads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | business-startup[.]azurewebsites[.]net | Attacker-used domain listed among phishing, SEO-poisoning, and infrastructure domains associated with MiniFast delivery. |
| DOMAIN | business-startup[.]org | Domain listed among phishing, SEO-poisoning, and infrastructure domains used to deliver MiniFast. |
| DOMAIN | getsqldeveloper[.]com | Fake SQL Developer download site identified as malicious MiniFast delivery infrastructure and promoted through SEO poisoning. |
| SHA256 | 0291ef318576953f7f3fe287e7775ed1d7c3206119dc7b9cd6d85c02779e6e40 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 10fd541674adadfbba99b54280f7e59732746faf2b10ce68521866f737f1e46d | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 2c214494fd0bad31473ca8adce78a4f50847876584571e66aadeae70827ec2dc | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 485f182f7b74ea4013b2539275a95d21e3a9bf0082c331937af9353a324b36f3 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 5c3362d20229597d11380f56d1f2eb39647fb6afad7be8392a7abcd18dff12f8 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 63d0d3c4a7f71bdbca720903d6a99b832089cc093c64d2938e7e001e56c17ab4 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 64530d7e6ee30e4a66d9eeed6b8595c33fd72f5f73409133ca40539e5695df4c | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 781605ce9d4a9869e846f6c9657d71437cb6240ab27ffbc4cd550c0e06996690 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | 9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | a13ba3c5aff46e9daf2d23df4b3e3d49dc7236c207c56f0a1433051f3450d441 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | a57ffb819fe8d98ff925c5d7b239598fe302acf5a13193d7a535040a71298fdf | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | ecaf493c320d201d285ef5f61d75744216e47cf1115b4af528f9a78883cc446e | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | f08b17856616d66492a24dced27f788e235f35f42fa7cd10f315000d3a2f4c03 | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
| SHA256 | f54cd38632ac9da3af3533ae93e92625cbcb04df521dbf1b6acfaa81218f9e8c | SHA-256 hash of a loader, payload, or infrastructure-related binary listed as a campaign IOC. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationLoaders obfuscated strings with ROT13 and reversed-string transformations, and the first-stage loader stored the next payload encrypted.T1036.005 · Match Legitimate Resource Name or LocationThe campaign used legitimate-software appearances, application-like file locations, and a renamed binary, Update.exe, to disguise malicious components.T1041 · Exfiltration Over C2 ChannelMiniFast uploaded local files to its C2 server through the /upload/ endpoint.T1053.005 · Scheduled TaskThe malware hijacked a scheduled task created by the Zoom installer and MiniFast could create or update a WindowsSecurityUpdate task.T1057 · Process DiscoveryMiniFast enumerated running processes and returned process names and PIDs.T1059.003 · Windows Command ShellMiniFast executed operator-supplied shell commands using cmd.exe /c.T1071.001 · Web ProtocolsMiniFast communicated with its C2 infrastructure over HTTP using API-style endpoints and JSON-formatted exchanges.T1082 · System Information DiscoveryMiniFast collected host information, including username, hostname, and domain information, for C2 registration.T1083 · File and Directory DiscoveryMiniFast listed files and folders in a specified directory.T1105 · Ingress Tool TransferMiniFast downloaded files from its C2 server to the infected machine.T1132.001 · Standard EncodingMiniFast used Base64-encoded task structures received from C2 and Base64-encoded execution results sent back to C2.T1204.002 · Malicious FileInfection began when victims downloaded and launched weaponized ZIP contents or installers, including Setup.exe.T1497.001 · System ChecksThe second-stage loader checked that the hosting process was update.exe and its parent was svchost.exe before continuing.T1566 · PhishingThe actor used career-themed phishing lures and fake meeting invitations to induce targets to obtain malicious archives or installers.T1574.009 · Path Interception by Unquoted PathTrojanized .config files specified an attacker-controlled AppDomainManager that loaded malicious DLLs through trusted .NET applications.
Threat Actors
Nimbus ManticoreThe article attributes the phishing, SEO-poisoning, AppDomain Hijacking, and MiniFast operations to Nimbus Manticore; it identifies UNC1549 as another tracking name for this IRGC-affiliated threat actor.UNC1549The article identifies UNC1549 as another tracking name for Nimbus Manticore, which it attributes with the reported phishing, SEO-poisoning, and malware operations.
Malware
Products
SQL DeveloperThe campaign used phishing lures, a Trojanized Zoom installer, and a fake SQL Developer download site to target aviation and software organizations across the United States, Europe, and the Middle East.ZoomThe campaign used phishing lures, a Trojanized Zoom installer, and a fake SQL Developer download site to target aviation and software organizations across the United States, Europe, and the Middle East.
Countries
AustraliaTargeted organizations in Saudi Arabia and Australia were directed to download a compressed ZIP archive stored on the OnlyOffice platform.Iranthreat actor Nimbus Manticore resurfaced during Operation Epic Fury, the US military campaign against Iran launched on February 28, 2026, demonstrating newly adopted techniques and enhanced capabilities.IsraelIn February 2026, amid rising tensions between the US, Israel and Iran and weeks of military buildup, we monitored new Nimbus Manticore phishing activity worldwide.Saudi ArabiaTargeted organizations in Saudi Arabia and Australia were directed to download a compressed ZIP archive stored on the OnlyOffice platform.United Arab EmiratesNimbus Manticore consistently focuses on Europe, the Middle East and Africa, particularly Israel and the United Arab Emirates.United StatesThe campaign used phishing lures, a Trojanized Zoom installer, and a fake SQL Developer download site to target aviation and software organizations across the United States, Europe, and the Middle East.
Industries
AviationThe campaign used phishing lures, a Trojanized Zoom installer, and a fake SQL Developer download site to target aviation and software organizations across the United States, Europe, and the Middle East.DefenseNimbus Manticore is an IRGC-affiliated threat actor that has long targeted defense, aviation, and telecommunications organizations.Software developmentOur findings indicate targeting extends across several strategic sectors, including aviation and software development.TelecommunicationsNimbus Manticore is an IRGC-affiliated threat actor that has long targeted defense, aviation, and telecommunications organizations.