Executive Summary
Cybersecurity researchers have identified an aggressive cyber espionage campaign orchestrated by the Iranian state-sponsored threat group Nimbus Manticore (affiliated with Iran's Ministry of Intelligence and Security, MOIS). The campaign targets software engineers, DevOps specialists, and IT professionals across North America, Europe, and the Middle East by posing as technical recruiters on LinkedIn and professional platforms. The attackers lure candidates into downloading trojanized coding challenge archives that silently install two newly discovered cross-platform Remote Access Trojans (RATs), named NodeRabbit and PollCat, engineered to infiltrate Linux, Apple macOS, and Windows workstations.
Deep-Dive Technical Analysis
Social Engineering & Multi-Stage JavaScript Execution Flow
Nimbus Manticore (also tracked under monikers overlapping with TA453 and Cobalt Mirage) has evolved its tradecraft to target developer machines directly, seeking to harvest proprietary codebases, cloud infrastructure tokens, and internal corporate access:
1. LinkedIn Recruiter Persona Lures:
- Threat actors establish detailed, credible recruiter profiles on LinkedIn, masquerading as talent acquisition specialists for global tech firms.
- After engaging software developers with lucrative job offers, the recruiters direct victims to review a technical assessment hosted on GitHub or shared via cloud file-sharing links.
2. Trojanized Coding Challenge Archives:
- The provided zip archives contain seemingly genuine full-stack programming tests (such as Node.js, React, or Python microservice projects) accompanied by detailed README instructions.
- When the developer executes standard installation routines (such as running `npm test` or `npm start`), a hidden malicious script embedded inside the package's build scripts or task runners executes automatically in the background.
3. NodeRabbit Cross-Platform RAT Architecture:
- Payload Characteristics: NodeRabbit is a modular remote access trojan written in native Node.js, granting it seamless cross-platform execution across macOS, Linux, and Windows environments without requiring binary recompilation.
- Persistence & Evasion: It establishes persistence via user-level cron jobs on Linux/macOS or Scheduled Tasks in Windows registry run keys. The malware checks for virtualization, active debuggers, and developer security tools before initializing communications.
- Command & Control (C2): NodeRabbit communicates with attacker C2 infrastructure via encrypted WebSocket channels and HTTPS POST beacons disguised as benign analytics telemetry.
4. PollCat Auxiliary Stealer & Post-Exploitation Capabilities:
- In parallel, the threat actors deploy PollCat, a secondary obfuscated JavaScript malware designed for rapid host reconnaissance and credential harvesting.
- PollCat systematically scans developer environments for high-value targets:
- Local `.aws/credentials`, `.azure/tokens`, and Google Cloud service account keys.
- SSH private keys (`~/.ssh/id_rsa`, `~/.ssh/id_ed25519`).
- Git credentials, active environment variables (`.env` files), and browser-stored session cookies.
- Shell history files (`.bash_history`, `.zsh_history`) to identify internal network topologies and administrative commands.
Threat Analysis: Developer Workstations as Primary Enterprise Gateways
The targeting of software engineers represents a high-yield strategic vector for nation-state intelligence agencies:
- Bypassing Corporate Perimeters: Modern developers frequently operate on remote workstations or Bring Your Own Device (BYOD) hardware with direct VPN access to production cloud environments (AWS, GCP, Azure) and code repositories (GitHub, GitLab).
- Stealthy Execution in Developer Toolchains: Security operations centers (SOCs) typically whitelist Node.js, Python, and terminal activity on developer endpoints, allowing NodeRabbit and PollCat to execute without triggering standard endpoint detection and response (EDR) heuristics.
Actionable Recommendations & Mitigations
1. Sandbox Unverified Coding Assessments: Developers must execute all external coding tests, third-party GitHub repositories, and candidate code inside completely isolated, ephemeral virtual machines (VMs) or containerized sandboxes lacking access to corporate networks or personal credentials.
2. Audit npm and Package Scripts: Before executing `npm install` or running build scripts on unfamiliar projects, inspect `package.json` for suspicious `preinstall`, `postinstall`, or custom test hooks.
3. Protect Cloud and SSH Credentials: Enforce short-lived, identity-bound cloud credentials (such as AWS IAM Identity Center or workload identity federation) and store sensitive SSH private keys in hardware security keys (FIDO2/YubiKey) rather than plaintext files on disk.
4. Implement Developer Endpoint Monitoring: Configure EDR solutions to alert on anomalous child processes spawned by Node.js or Python daemons, particularly when Node runtime processes initiate unauthorized network sockets or read from `~/.ssh/` and cloud credential directories.
---
Sources & References: The Hacker News, Kaspersky Threat Research, Mandiant Threat Intelligence.