Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays

Nimbus Manticore, an Iranian state-backed hacking group, has been linked to a new series of attacks targeting organizations in the Middle East, Africa, and South Asia. The group is using a previously undocumented Windows backdoor called NightLedger, along with custom WebSocket tunnelers, to carry out the intrusions. These attacks enable the group to turn compromised systems into covert relays. The hacking group is also known by several other names, including GalaxyGato and UNC1549. The use of NightLedger and the WebSocket tunnelers allows Nimbus Manticore to maintain access to victim systems. The group's activities have been detected across multiple regions.