Nimbus Manticore (UNC1549/IRGC) SQL Developer SEO Poisoning Campaign Delivers MiniFast Backdoor via AppDomain Hijacking — Operation Epic Fury Wave 3 — Threadlinqs Intelligence
As of 2026-05-30, Nimbus Manticore (UNC1549/IRGC) SQL Developer SEO Poisoning Campaign Delivers MiniFast Backdoor via AppDomain Hijacking — Operation Epic Fury Wave 3 is a high-severity malware threat attributed to UNC1549 (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 64 indicators of compromise.
Threat ID: TL-2026-0581 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: UNC1549 · Iran · ESPIONAGE
Iranian APT Nimbus Manticore (UNC1549, IRGC-affiliated) executed the 'SQL Developer' campaign in April 2026, the third and final wave of Operation Epic Fury (February–April 2026). The actor registered
On 22 May 2026 Check Point Research published 'Fast and Furious — Nimbus Manticore Operations During the Iranian Conflict', documenting three Nimbus Manticore (UNC1549) campaign waves that ran February–April 2026, coinciding with the US/Israel-Iran military confrontation. The third wave, tracked here as TL-2026-0581, represents a significant TTP shift away from the group's traditional fake-job-offer spearphishing toward opportunistic SEO poisoning of software search queries.
INITIAL ACCESS — SEO POISONING. The actor stood up getsqldeveloper[.]com as a near-pixel-perfect clone of Oracle's SQL Developer download page. Reputation was manufactured by dozens of linking 'doorway' domains (azurewebsites.net subdomains, business-startup[.]org, ramiltonsfinance[.]com, PremierHealthAdvisory[.]com, nanomatrix.azurewebsites[.]net, globalitconsultants.azurewebsites[.]net, peerdistsvcmanagers.azurewebsites[.]net, etc.) plus aggressive keyword stuffing of 'Download SQL Developer'. The site achieved top placement on Bing and DuckDuckGo for 'sql developer' queries. Victims downloading the binary received a ZIP archive structured identically to the Wave 2 Zoom-themed package: a benign Microsoft-signed Setup.exe (ServiceHub.VSDetouredHost.exe), Setup.exe.config (the AppDomain Hijacking config), a first-stage loader DLL (InitInstall.dll), UpdateConfig.xml (a second AppDomain config), Updater.dll (second-stage loader), and UpdateChecker.dll (the MiniFast payload, exposed via the CheckForUpdates export).
EXECUTION — APPDOMAIN HIJACKING. When the victim runs Setup.exe, the .NET runtime parses the colocated Setup.exe.config file, which specifies an attacker-controlled AppDomainManager assembly (InitInstall.dll). The runtime resolves and loads the malicious DLL inside the trusted Microsoft-signed binary's process. InitInstall.dll first validates its host is Setup.exe, displays a decoy error ('Couldn't connect to survey server'), and then drops the stage-2 payload tree into C:\Users\<USER>\AppData\Local\Zoom\bin\update\ (the Wave-3 SQL Developer variant reuses Wave-2's Zoom-themed AppData layout). A second AppDomain Hijack — driven by UpdateConfig.xml against the renamed Update.exe — loads Updater.dll, which side-loads UpdateChecker.dll and invokes its CheckForUpdates export. Updater.dll validates its host process is update.exe with parent svchost.exe before continuing. Both loader DLLs employ runtime string decryption combining ROT13 with reversed-string transformations.
PERSISTENCE. Instead of creating new scheduled tasks, MiniFast hijacks legitimate Zoom auto-update tasks (ZoomUpdateTaskUser-<SID>) by rewriting their action target — blending with expected user-mode scheduled tasks. The optional MiniFast persistence opcode 0xB1 installs a fresh scheduled task named 'WindowsSecurityUpdate' pointed at the MiniFast binary path.
C2 PROTOCOL — MINIFAST. MiniFast is a 64-bit Windows PE DLL backdoor designed as a long-stay RAT, replacing the prior MiniJunk/MiniUpdate families documented in TL-2026-0562. It communicates over HTTP with a hardcoded Chrome User-Agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36'. The endpoint map is structured: POST /rg performs the initial handshake (the server responds HTTP 400 with a JSON body containing socketId, pollInterval defaulting to 120000 ms, and jitterTime of 5000 ms); POST /agent/init registers the victim with computer name, user name, domain, and elevation state; GET /agent/poll?token= retrieves base64-wrapped task structures; POST /agent/result returns base64-encoded result envelopes (taskIdLen, taskId, status uint32, resultText); PUT /upload/ exfiltrates files; GET /files/ pulls operator-pushed payloads.
COMMAND SET. Tasks are dispatched by single-byte opcode: 0x02 list directory, 0x03 move/rename, 0x04 execute shell (cmd.exe /c), 0x05 enumerate processes, 0x06 delete, 0x07 download from C2, 0x08 upload to C2, 0x09 enumerate drives, 0x0A
Weaknesses (CWE)
CWE-426, CWE-829, CWE-494, CWE-345
Target sectors: aviation, aerospace, defense, telecommunications, software-development, critical-infrastructure
Target regions: Europe, Middle East, Israel, United Arab Emirates, Africa, North America
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 64 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.001, T1583.006, T1588.003, T1608.004, T1608.006, T1587.001, T1189, T1204.002, T1204.002, T1059.003