Nimbus Manticore Deploys NightLedger Backdoor

Introduction

Over the past year, a surge of covert cyber operations has been traced back to an Iranian intelligence‑linked collective that researchers have labeled Nimbus Manticore. Known by a series of aliases — including GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549 — this group has refined its tactics, tools, and objectives, moving beyond traditional data theft toward a more insidious model of using compromised hosts as hidden relay nodes.

The latest activity involves the deployment of a previously undocumented Windows backdoor named NightLedger, coupled with custom WebSocket tunnelers that enable the creation of a covert communications fabric. This report examines how the backdoor operates, the mechanisms behind the tunnelers, and the broad geographic footprint observed across the Middle East, Africa, and South Asia.

The strategic intent behind using compromised hosts as relays is to create a decentralized command structure that evades traditional sinkhole takedowns, making attribution and remediation more complex for defenders.

NightLedger: A Stealthy Windows Backdoor

The NightLedger backdoor is a compact executable designed to blend seamlessly with legitimate system processes. Once a victim machine is infected — often via a malicious attachment, a compromised remote‑desktop session, or a drive‑by download — the payload establishes persistence through scheduled tasks and registry modifications, ensuring it survives reboots and user logoffs.

• Stealthy process injection that allows the backdoor to run hidden within trusted system services.
• Credential harvesting modules that capture login details from browsers, email clients, and remote‑access tools.
• Screenshot and keylogging functions that provide attackers with visual and textual intelligence.
• Remote command execution, enabling the operator to download additional payloads or issue commands directly.
• Most critically, a relay service that routes outbound traffic through the infected host, effectively turning each compromised device into a silent proxy for data exfiltration and command‑and‑control traffic.

WebSocket Tunnelers: Enabling Covert Relay Channels

To keep the relay traffic invisible to firewalls and deep‑packet inspection, Nimbus Manticore employs two specialized WebSocket tunnelers. Both tools open outbound WebSocket connections that masquerade as ordinary web browsing traffic, leveraging the ubiquity of HTTPS‑enabled sites to bypass inspection.

• The first tunneler initiates persistent connections to cloud‑based endpoints, allowing the backdoor to maintain a constant channel for command receipt and data exfiltration.
• The second tunneler creates peer‑to‑peer WebSocket links between compromised hosts, forming a decentralized mesh that can dynamically scale as new victims are infected.
• Both tunnelers encrypt the data stream with strong symmetric ciphers, ensuring that even if the traffic is captured, the content remains unreadable without the appropriate decryption keys.
• Dynamic scaling capability means the relay network can expand organically, reducing the need for a centralized command server and thereby increasing resilience against takedown attempts.

Geographic Reach and Target Profile

Operational analysis indicates that the campaign has struck a diverse set of entities across three continents. In the Middle East, government ministries, energy firms, and telecommunication providers have been primary targets. African victims include financial institutions, educational establishments, and regional NGOs, while South Asian targets span corporate enterprises, healthcare facilities, and public sector agencies.

• Initial infection vectors predominantly involve spear‑phishing emails containing malicious Office documents, as well as exploitation of unpatched remote‑desktop services.
• Once the backdoor gains foothold, it rapidly propagates the relay network, converting each infected system into a covert node that forwards traffic on behalf of the threat actor.
• The extensive geographic dispersion suggests the attackers are deliberately harvesting a wide range of IP addresses to obscure the true origin of their command‑and‑control communications.

Conclusion

The emergence of NightLedger and its integrated WebSocket tunnelers underscores the growing sophistication of state‑backed threat actors. As Nimbus Manticore continues to expand its influence, organizations worldwide must strengthen their detection and response capabilities to mitigate the risk of their systems being repurposed as covert data relays. Grivyonx Cloud’s advanced automation and cybersecurity services can help enterprises stay ahead of evolving threats by providing real‑time threat intelligence and automated remediation workflows, ensuring that compromised assets are isolated before they can be leveraged in broader espionage campaigns.