Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

Iranian hacking group Nimbus Manticore has been linked to two new malware families that demonstrate an expansion of its capabilities. These malware families are cross-platform remote access trojans developed using Node.js and JavaScript, allowing them to infect Linux and Apple macOS systems. The group's tactics involve posing as recruiters who send coding tests to targets, which deliver the malware. Kaspersky, a Russian cybersecurity company, is monitoring the activities of this group. The new malware families indicate the group's evolving toolset and potentially broader targeting scope.