{"id":2042,"date":"2026-07-28T13:43:03","date_gmt":"2026-07-28T13:43:03","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2042"},"modified":"2026-07-28T13:43:03","modified_gmt":"2026-07-28T13:43:03","slug":"nimbus-manticore-deploys-nightledger-and-turns-victim-systems-into-covert-relays","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2042","title":{"rendered":"Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 28, 2026<\/span><\/span>Malware \/ Cyber Espionage<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Iranian state-backed hacking group tracked as Nimbus Manticore<\/strong> (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia.<\/p>\n

The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers, BridgeHead and ArcBridge, with an aim to maintain covert access.<\/p>\n

Targets of the campaign include Egypt, SMB and government environments in Jordan and Tanzania, aviation organizations in Pakistan, telecommunication companies in Ethiopia, and financial-sector entities in Burkina Faso, per Kaspersky.<\/p>\n

\u00abThe toolset includes NightLedger, a new Windows backdoor for reconnaissance, command execution, file operations, process discovery, and screenshot capture; and two custom WebSocket-based tunnelers, ArcBridge and BridgeHead, for covert network access and operator-controlled tunneling,\u00bb Kaspersky researchers Omar Amin and Vasily Berdnikov said<\/a>.<\/p>\n

The exact initial access method used in the attacks is presently unknown, although the adversary is known to employ highly tailored job opportunity-themed phishing lures masquerading as trusted brands and hiring platforms, as well as lookalike videoconferencing pages, to redirect recipients to malicious archives hosted on third-party file-sharing services.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The as-yet-undetermined access route is then abused to deliver the malicious payloads, including NightLedger, which is launched as a DLL via DLL side-loading. The malware is designed to contact an external server over HTTPS to parse and run commands in a manner that’s analogous to TWOSTROKE, another backdoor deployed by the threat actor in the past. The list of supported commands is below –<\/p>\n