Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
Iranian hackers, operating under the Nimbus Manticore group, are using sophisticated cross-platform remote access trojans (RATs) to target developers and system administrators. They are leveraging recruitment-themed lures – specifically programming challenges and developer assessments – to deliver malware like NodeRabbit and PollCat. These tools are designed to operate across Windows, Linux, and macOS, and utilize Azure-hosted command-and-control servers. The group employs a tactic similar to the Lazarus Group, using AI-assisted project creation to create realistic developer challenges and deliver malware seamlessly.
The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families – NodeRabbit and PollCat – highlighting the group's continued evolution and expanding targeting footprint to include Linux and Apple macOS systems. Russian cybersecurity company Kaspersky is tracking these malware strains.
NodeRabbit, initially discovered on systems in Afghanistan, Egypt, and Ethiopia, is delivered through spear-phishing messages on LinkedIn and other job search platforms, masquerading as a talent acquisition specialist at a major technology company. The group invites candidates to complete a technical assignment – a programming challenge – within a limited timeframe, without using AI-assisted tools.
The challenge archive contains source code for a project management tool called Taskflow and instructs candidates to "find and fix all bugs in the frontend code" within three hours. However, the malicious code is embedded within the server component of the application, specifically in the `server.js` file. The first line of this file imports a trojanized npm package named `colorized_terminal` (version 2.1.0).
NodeRabbit communicates with three Azure-hosted command-and-control (C2) addresses: `plugplay.azurewebsites[.]net`, `rgbteller.azurewebsites[.]net`, and `wslwebui.azurewebsites[.]net` through three distinct API endpoints: `/api/rabbit/checkin`, `/api/rabbit/task`, and `/api/rabbit/result`. The malware supports 11 commands, enabling it to gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read a file in chunks, decode Base64-encoded text, write it at a chosen file offset, delete a file or recursively delete a directory, create directories recursively, enumerate adapters, MAC addresses, IP addresses, and DNS settings, and alter beacon interval. It also has a capability to write a Base64-encoded Node.js script to a randomly named `.tmp` file, execute it, and then delete it to cover up traces of malicious activity.
NodeRabbit has two variants that share the same code lineage, each recovered from Egypt and Ethiopia. A second variant uses a different trojanized npm package named `pretty-log` (version 2.1.0) instead of `colorized_terminal`, while also terminating if found to be running in an analysis environment and partially implementing corporate proxy support. A third variant uses `pretty-log` but with different API endpoints: `/sdk/v2/ready`, `/sdk/v2/config`, and `/sdk/v2/events`.
Persistence is achieved through various OS-specific mechanisms: a Windows Run registry key on Windows, a cron entry for Linux, and a launch agent on macOS. The malware mimics either a Microsoft Edge browser update (first variant) or Intel's Driver & Support Assistant (second variant). The third variant does not impersonate any legitimate software but also takes into account the Windows Subsystem for Linux (WSL) to create a daily 10 a.m. Windows task that launches a Visual Basic Script file through `wscript.exe` and