Nimbus Manticore APT Abuses Fake Recruitment Portal to Deliver Custom Malware

A state-linked hacking group has been caught running a carefully crafted fake recruitment operation to push custom malware onto unsuspecting victims.

The group, known as Nimbus Manticore and also tracked as UNC1549 and Smoke Sandstorm, has a long history of targeting professionals in the aerospace and defense sectors across the Middle East and Europe.

Their latest campaign shows a notable step up in technical sophistication, blending social engineering with a multi-stage malware delivery chain that is hard to detect.

The attackers started by reaching out to employees on LinkedIn through a fake but convincing recruiter profile. The persona claimed to be headhunting talent for Ebix, a real company in the insurance and banking technology space, and dangled a salary offer of $200,000 to make the pitch more appealing.

Victims were then directed to a polished fake hiring portal at ebix[.]recruitment-flow[.]com, which required login credentials before any malicious content was served.

Analysts at Nextron identified this sophisticated sideloading infection chain during a recent incident response engagement, attributing the activity to Nimbus Manticore with confidence. 

Nextron said in a report shared with Cyber Security News (CSN) that the group’s core tradecraft stays remarkably consistent across campaigns, even as individual tools and payloads shift between operations.

The report details how the operators have evolved their techniques while keeping the same underlying patterns in place.

Once logged into the fake portal, victims were prompted to download what appeared to be a two-factor authentication app for added security during the hiring process.

That app arrived as a ZIP archive carrying the actual malware. The entire flow was designed to look routine, lowering the victim’s guard at every step before the payload had a chance to execute.

Nimbus Manticore APT Abuses Fake Recruitment Portal

The ZIP archive contained a renamed Microsoft Visual Studio component called setup.exe, which is legitimately signed by Microsoft.

The attackers modified its configuration file to trick the .NET runtime into loading a malicious library named TOTPGuard.dll instead of following normal execution.

This technique, known as AppDomain hijacking, meant the initial process appeared clean and was unlikely to trigger standard security alerts.

After the victim ran setup.exe, they were shown a convincing fake Ebix interface asking for a secret key and then displayed a working one-time password generator.

The app behaved like a real tool throughout the process, making it far harder for victims to suspect anything was wrong.

Behind the scenes, the malware decrypted an embedded payload using hardcoded AES keys and dropped it to disk at a path inside the user’s AppData folder.

Persistence, C2, and Evasion Tactics

The malware then created a scheduled task named “BackupCheck” to run at every login, ensuring it stayed active on the infected machine.

The main payload, stored as main.dll, communicated with command-and-control servers hosted on Microsoft Azure, a trusted cloud platform that blends into normal network traffic for many organizations.

The C2 domains used benign-sounding names that matched the hiring campaign theme, making them easy to overlook during a quick review.

The native implant also ran anti-analysis checks, including verifying its own process name and checking for active debuggers by inspecting the Process Environment Block.

The operators appeared to significantly increase the level of code obfuscation compared to earlier campaigns, likely in response to prior public reporting from other security vendors.

Despite these added layers, the core functionality, including data exfiltration and C2 communication, remained consistent with previously documented Nimbus Manticore behavior.

Defenders can take several concrete steps to reduce exposure to this type of attack. Organizations should block or restrict access to freshly registered domains, particularly in sensitive departments like HR, finance, and legal.

Using Windows AppLocker to prevent execution from user-writable directories such as AppData and Temp can significantly reduce the chance of staged payloads running.

Security awareness training should also expand beyond email-based phishing to include social media platforms and job portal-based social engineering, where this group has proven especially active.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.