Iranian APT Group Targets Aviation and Software Firms with Updated Tools

An Iranian advanced persistent threat (APT) group known as Nimbus Manticore has escalated its cyber operations against aviation and software companies by deploying updated tools and adopting sophisticated tactics, according to recent research from cybersecurity firm Check Point. Also identified under aliases such as Bohrium, Smoke Sandstorm, TA455, and UNC1549, Nimbus Manticore is believed to be a subgroup of the notorious Charming Kitten (APT35) and is linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). Active since at least 2022, the group has historically targeted aerospace, aviation, and defense sectors across the Middle East and Europe, employing backdoors like MiniBike and MiniBus.

Recent campaigns reveal that Nimbus Manticore has broadened its scope to include American aviation firms. The group has employed phishing lures and engine poisoning tactics to compromise victims, a strategic shift coinciding with heightened geopolitical tensions in the Middle East and ongoing US military actions against Iran since February 2026. Despite these aggressive efforts, researchers from Palo Alto Networks’ Unit 42 report no confirmed breaches of targeted oil, gas, or aviation companies to date.

Check Point’s analysis highlights a notable evolution in the group’s malware delivery methods. Nimbus Manticore has transitioned from traditional DLL sideloading to a more advanced technique known as AppDomain hijacking for payload execution. This method involves placing a trojanized XML configuration file within a target .NET application’s directory, enabling the malicious DLL to load upon application launch. In one campaign, employees at aviation and software firms in Saudi Arabia and Australia were targeted with phishing emails containing links to compressed ZIP archives hosted on the OnlyOffice platform. These archives delivered a new variant of the MiniJunk backdoor.

In a separate operation, the group deployed fraudulent job offers impersonating a US-based airline, which led to the installation of a trojanized Zoom installer. Utilizing AppDomain hijacking, this infection chain installed a new backdoor named MiniFast. This 64-bit Windows PE DLL masquerades as a Chrome browser and is designed for long-term persistence and remote command execution. MiniFast grants attackers capabilities to manipulate and exfiltrate files, enumerate and terminate processes, manage directories, create scheduled tasks, and deploy additional payloads.

Check Point further notes Nimbus Manticore’s rapid adaptability, robust infrastructure maintenance, and continuous tool development, likely supported by large language model (LLM)-based and AI-assisted techniques. In April, the group was observed distributing the MiniFast backdoor through a fake SQL Developer download website. This campaign exploited engine optimization (SEO) strategies, employing dozens of domains to elevate the fake site’s ranking for queries such as “sql developer” on engines including Bing and DuckDuckGo, thereby increasing the chances of deceiving unsuspecting users.

While Nimbus Manticore’s operations have traditionally concentrated on the Middle East, Europe, and Africa—primarily targeting Israel and the United Arab Emirates—recent activities indicate a strategic pivot toward US organizations. Fraudulent hiring portals impersonating aviation companies have been used to target employees and organizations within the American aviation sector.

Other Iranian state-aligned groups remain active in the cyber domain. For instance, MuddyWater has been linked to a “false flag” ransomware attack that exploited Microsoft Teams for credential theft, underscoring the evolving and diverse tactics employed by Iranian cyber actors.