# Iran's Nimbus Manticore Is Building a Shadow Network — Your Systems Are the Nodes
When a nation-state threat actor drops a new backdoor, the instinct is to focus on the malware itself. With Nimbus Manticore's latest campaign, that's exactly the wrong instinct. The real story is what they're doing *after* they're in: converting victim infrastructure into a distributed relay network that makes attribution harder and persistence nearly invisible.
The Iranian state-sponsored group — tracked variously as Nimbus Manticore, GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549 depending on which intelligence team is writing the brief — has been attributed to a fresh wave of intrusions spanning the Middle East, Africa, and South Asia. The campaign introduces a previously undocumented Windows backdoor called NightLedger, paired with two custom WebSocket tunnelers built to make compromised hosts do the dirty work of routing command-and-control traffic.
## Five Names, One Objective
The alias proliferation around this group is itself instructive. Mandiant, CrowdStrike, Microsoft, Palo Alto, and independent researchers have all named variations of the same actor as they observed overlapping infrastructure, TTPs, and targeting patterns over several years. That fragmentation of the intelligence picture is partly operational security on Iran's side — the group deliberately retools between campaigns, swaps infrastructure, and reuses code selectively to blur the threads researchers follow.
What connects the aliases is consistent targeting logic: entities along corridors of strategic interest to Tehran. The Middle East angle is obvious — regional rivals, neighboring governments, energy infrastructure. But the Africa and South Asia vectors are worth reading carefully. Iran has steadily expanded its intelligence collection priorities southward into East Africa and across to Pakistan and India, tracking both regional political dynamics and diaspora networks. Any campaign hitting all three simultaneously isn't opportunistic; it's coordinated collection.
## NightLedger: Purpose-Built to Stay Quiet
Details on NightLedger's full capability set remain partially redacted in current reporting — which is itself a signal that affected parties and intelligence agencies are still working the problem. What's confirmed is that it's a Windows backdoor, previously undocumented, which means Nimbus Manticore had it in development and operational use before any public defender had a detection signature.
The "previously undocumented" qualifier matters more than it sounds. Iran's cyber operators have a documented pattern of running parallel toolsets: one that's been exposed and therefore baits detection, and one that's clean. The exposure of an older implant becomes a diversion. While defenders are tuning rules for the known tool, the clean one continues operating in the same environment. NightLedger almost certainly wasn't built for this campaign — it was probably field-ready for months before this attribution surfaced.
The naming convention is also worth noting. "NightLedger" fits the Iran-nexus naming pattern of abstract, evocative terms — contrast with Russian operators who often use acronyms or Western-sounding names, or Chinese operators who favor more technical designations. It's a minor detail, but malware names often carry residue of the operator's internal culture.
## The Relay Architecture Is the Point
The two custom WebSocket tunnelers are where this campaign separates itself from a routine espionage operation.
WebSocket tunneling over HTTPS is a well-understood evasion technique at this point — it's the same mechanism that makes tools like Chisel and ngrok effective for legitimate remote access and, inevitably, for threat actors borrowing the same logic. But custom-built tunnelers, rather than off-the-shelf tools, indicate a deliberate operational security choice: no shared signatures with commodity tooling, no version fingerprints, no GitHub repos for defenders to pull indicators from.
The relay architecture this enables is genuinely nasty. By routing C2 traffic through compromised victim systems, Nimbus Manticore achieves several things simultaneously. First, outbound connections from a compromised host look like they're going to another legitimate organization rather than to a known Iranian IP range — that's the detection problem. Second, the actual C2 infrastructure becomes harder to disrupt; taking down the relay node doesn't burn the operator's real infrastructure. Third, and most useful for long-running espionage, the relay topology can be reconfigured. Victim A routes to victim B which routes to victim C. Burn victim A and the chain reconstitutes.
This mirrors a technique that Russian APT groups — particularly Sandworm and Turla — have refined over the past several years. The convergence of nation-state tactics toward proxy-chaining through civilian infrastructure is one of the cleaner trends in advanced threat behavior right now, and Iran's operators are clearly studying the playbook.
## Who Should Be Reading This Carefully
The targeting footprint — Middle East, Africa, South Asia — sounds geographically contained until you map it against the industries typically in scope for Nimbus Manticore. Prior campaigns attributed to UNC1549 hit aerospace, defense contractors, aviation, and energy. Those sectors don't respect borders. A defense contractor in South Asia with a European parent company is exposed. An energy operator with regional offices across East Africa is exposed. A logistics firm serving Middle Eastern governments is exposed.
Any organization that:
...should treat this campaign as directly relevant, not background noise.
The relay angle adds a second-order concern: organizations with no direct nexus to the campaign can still find themselves unwitting participants. If you're a European IT services firm and one of your clients is in the target geography, your infrastructure could be enrolled as a relay node without you or the client knowing.
## For Defenders Right Now
Detection priority should sit on outbound WebSocket connections that don't match expected application behavior — particularly long-lived sessions with irregular data cadence, which is characteristic of C2 tunneling. Endpoint telemetry from Windows hosts should be reviewed for unexpected processes initiating WebSocket connections, especially those with no parent process chain that maps to a recognized application.
NightLedger is new enough that detection signatures will lag deployment. Behavioral detection — unusual persistence mechanisms, unexpected Windows service creation, privilege escalation patterns, and anomalous credential access — is more reliable here than waiting for AV vendors to catch up.
Network defenders should specifically audit any hosts that have initiated connections to recently registered domains or IP space in regions with no prior business relationship. The relay infrastructure Nimbus Manticore is building will, by design, use addresses that look legitimate in the short term.
---
## HackWire Analysis
The thing that gets underplayed in most coverage of Iranian state APT activity is the operational maturity curve. The group running under the Nimbus Manticore umbrella isn't the same animal it was during the early Mirage Kitten days, when it was mostly recycling commodity phishing kits. The custom tunnelers in this campaign represent genuine engineering investment, and the relay architecture suggests a strategic intent that goes beyond opportunistic espionage.
There's a specific parallel worth drawing: the 2023–2024 period saw Chinese APT actors (Volt Typhoon in particular) draw intense scrutiny precisely because they were building relay infrastructure through US critical infrastructure — not to steal data, but to pre-position for potential disruption. The strategic logic is identical here. A distributed relay network isn't just a collection tool; it's latent infrastructure that could serve different purposes later. Iran has operational reasons to maintain persistent access to organizations across three continents: intelligence collection now, influence operations later, and in a crisis scenario, the option to cause disruption.
The five-alias problem also deserves more attention. When the same actor has that many names, it means different intelligence teams have been tracking them for years without sufficient information sharing to converge on a single designation. That's not a research community failure — it reflects how deliberately the group has segmented its operations. The takeaway for defenders is that a "no matches" result against one threat actor database doesn't clear you. Cross-reference across all the aliases before concluding you're not a target.
For organizations in the affected sectors and geographies: this campaign is ongoing. Attribution is public now, which typically causes a temporary operational pause while the group rebuilds infrastructure, followed by a return with adjusted TTPs. The window to hunt for historical indicators of compromise in your environment is now, not after the next advisory.
— HackWire Editorial
---
## Related Coverage