Nimbus Manticore Targets Developers with Node.js-based Cross-Platform RATs

The Iranian threat actor Nimbus Manticore (also known as Iranian Dream Job) has expanded its arsenal with two new Node.js-based remote access trojans (RATs), NodeRabbit and PollCat. These tools are delivered via spear-phishing campaigns on platforms like LinkedIn, where attackers pose as recruiters. Victims are lured into downloading trojanized coding challenge archives containing a project management application. Malicious code is embedded within the project's 'server.js' file, which imports a trojanized npm package ('colorized_terminal' or 'pretty-log') to silently launch an implant. These RATs are cross-platform, affecting Windows, Linux, and macOS, and are used for cyber espionage. The group has historically used C, C++, and Go, but the shift to Node.js indicates an effort to blend into developer environments and simplify cross-platform deployment.

Attack Chain

1. Attacker establishes contact with a software engineer on LinkedIn, posing as a talent acquisition specialist.
2. Victim downloads a ZIP archive (e.g., 'Front-Technical-Challenge.zip') containing a project management tool.
3. Victim runs the 'server.js' component, which triggers the import of a trojanized npm package ('colorized_terminal' or 'pretty-log').
4. The malicious package executes an index.js file from 'node_modules/.cache/' as a detached background process.
5. The NodeRabbit/PollCat implant establishes C2 communication with Azure-hosted infrastructure via hardcoded API endpoints.
6. Malware ensures persistence using OS-specific methods (Windows Registry Run keys, Linux cron jobs, or macOS launch agents).
7. Attacker executes commands to harvest system data, steal browser/Outlook credentials, or inject persistence mechanisms into local Git repositories.

Impact

The campaign targets software engineers in critical sectors across the Middle East and Africa. Successful exploitation allows for complete remote control of the host, enabling data exfiltration, credential harvesting (including Outlook OST/PST files), and deep reconnaissance of the victim's development environment.

Recommendation

1. Block the C2 domains listed in the IOC table at the DNS resolver level to disrupt command-and-control communications.
2. Implement detection logic to monitor for unexpected npm package imports from non-registry locations or obscure paths within project 'node_modules' directories.
3. Prohibit the execution of untrusted coding challenges on systems with access to production environments or sensitive source code.
4. Hunt for the presence of the identified malicious npm package names ('colorized_terminal' v2.1.0, 'pretty-log' v2.1.0) in local node_modules folders.