Evolution of Nimbus Manticore: SEO Poisoning and AI-Assisted Malware in Operation Epic Fury

A sophisticated cyber campaign attributed to the Iranian IRGC-affiliated threat group Nimbus Manticore (also known as UNC1549) has surfaced, signaling a significant shift in the group’s operational methodology. The campaign, emerging amidst the geopolitical tensions of Operation Epic Fury (launched February 28, 2026), demonstrates an increased level of technical maturity, characterized by the integration of SEO poisoning and potentially AI-augmented malware development.

Historically, Nimbus Manticore has focused on the aviation, defense, and telecommunications sectors, primarily utilizing career-themed phishing lures. However, current intelligence indicates a broadening geographic and sectoral footprint, with active targeting across the United States, Europe, and the Middle East by impersonating high-value software providers and aviation entities.

From AppDomain Hijacking to Trojanized Installers

Earlier phases of the 2026 campaign utilized phishing emails containing ZIP archives hosted on legitimate platforms like OnlyOffice. These archives exploited AppDomain hijacking—a technique where attackers use crafted .config files to force trusted .NET applications to load malicious DLLs, effectively bypassing traditional security perimeters through stealthy execution.

As the campaign progressed during Operation Epic Fury, the group transitioned to a more complex infection chain involving a trojanized Zoom installer. This method allows the malware to blend into legitimate software update processes, making detection significantly more difficult for end-users and automated endpoint security tools.

Technical observations of this new infection chain include:

• Binary Impersonation: Use of legitimate, digitally signed binaries to evade heuristic detection.
• Persistence Mechanisms: Hijacking scheduled tasks via existing Zoom update frameworks.
• Advanced Obfuscation: Utilization of multi-stage loaders employing ROT13 and string reversal to frustrate static analysis.
• Evasion Tactics: Strict environment checks designed to detect and terminate execution within sandbox or virtualized environments.

The Debut of the MiniFast Backdoor

This latest operational phase marks the introduction of MiniFast, a 64-bit DLL that succeeds the group’s previous MiniJunk malware. MiniFast provides the threat actor with robust remote command and control (C2) capabilities, including:

• Full remote command execution via CMD.
• Granular file system manipulation (upload/download and directory enumeration).
• Process enumeration and task management.
• Stealthy C2 communication: Using structured HTTP requests and JSON-based exchanges, the malware masquerades as legitimate Google Chrome traffic to blend into standard web activity.

Strategic Shift: SEO Poisoning and Search-Driven Infection

According to a technical report by Checkpoint, the group has launched a third phase leveraging SEO poisoning. Rather than relying on direct phishing, attackers are now manipulating search engine rankings to drive victims toward malicious infrastructure.

The attackers registered the domain getsqldeveloper[.]com, masquerading as an official Oracle SQL Developer download portal. By employing keyword stuffing (e.g., “Download SQL Developer Free”) and deploying numerous supporting domains, the group successfully manipulated search results on platforms like Bing and DuckDuckGo to direct technical users toward malicious installers.

Evidence of AI-Assisted Malware Development

Forensic analysis of the MiniFast codebase has revealed patterns highly indicative of Large Language Model (LLM) or automated coding assistance. Analysts noted several tell-tale signs:

• Verbose and highly repetitive function naming conventions.
• Extensive, “boilerplate” error handling surrounding very simple API calls.
• An unusually modular code structure for a single-purpose backdoor.
• Embedded, highly detailed debug-style messages and logging within the production binary.

These traits suggest that Nimbus Manticore is leveraging AI to accelerate development cycles, allowing them to iterate on their malware and adapt to defensive countermeasures in real-time.

Conclusion

The evolution of Nimbus Manticore underscores a growing trend in the threat landscape: the convergence of geopolitical objectives with rapid technological innovation. By adopting SEO poisoning and AI-assisted development, the group has moved from traditional social engineering toward more automated, scalable, and stealthy delivery vectors. This shift necessitates a move toward more robust, behavior-based detection strategies to counter increasingly sophisticated APT actors.

Indicators of Compromise (IOCs)

Disclaimer: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.