Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Software engineers and technology firms in the Middle East and Africa
Incident: A targeted campaign using trojanized coding challenges to deploy NodeRabbit and PollCat RATs.
Impact: Unauthorized remote access and potential cyber espionage across multiple operating systems.
Attacker: Nimbus Manticore (also known as Iranian Dream Job or Mirage Kitten)
Analysis: The Nimbus Manticore group has pivoted to JavaScript-based malware, allowing them to target Windows, macOS, and Linux systems simultaneously. By masquerading as recruiters on LinkedIn, they trick engineers into executing trojanized npm packages under the guise of a coding challenge. This shift demonstrates a strategic move toward codebase universality to blend in with legitimate developer environments.
Recommendations: Verify recruiter identities through official company channels before downloading files.; Avoid running untrusted code from external archives directly on host machines.; Utilize isolated sandboxes or virtual machines when completing third-party technical assignments.
Source: The Hacker News / Kaspersky
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source