Nimbus Manticore (UNC1549 / Smoke Sandstorm) Fake Ebix Recruitment Portal — TOTPGuard.dll AppDomainManager Hijacking Sideloading Chain Delivering main.dll Implant — Threadlinqs Intelligence
As of 2026-06-02, Nimbus Manticore (UNC1549 / Smoke Sandstorm) Fake Ebix Recruitment Portal — TOTPGuard.dll AppDomainManager Hijacking Sideloading Chain Delivering main.dll Implant is a high-severity malware threat attributed to UNC1549 (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 38 indicators of compromise.
Threat ID: TL-2026-0656 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: UNC1549 · Iran · ESPIONAGE
IRGC-affiliated APT Nimbus Manticore (UNC1549 / Smoke Sandstorm) ran a LinkedIn recruitment lure impersonating headhunters for a fake 'Ebix' hiring portal (ebix[.]recruitment-flow[.]com), tricking
Nimbus Manticore — tracked by Google/Mandiant as UNC1549 and by Microsoft as Smoke Sandstorm — is an Iran-nexus (IRGC-affiliated) espionage actor that resurfaced during the Iranian conflict (Operation Epic Fury, the US military campaign against Iran launched 2026-02-28). This campaign, documented by Nextron Systems on 2026-06-01 and contextualized by Check Point Research on 2026-05-22, is a material escalation over the actor's earlier SQL Developer SEO-poisoning operation (TL-2026-0581): it introduces a new recruitment-portal initial-access vector and a new TOTPGuard.dll -> main.dll loader/implant pair.
INITIAL ACCESS & SOCIAL ENGINEERING: Operators impersonate recruiters on LinkedIn, dangling high-value (~$200,000 USD) aerospace/defense positions. Victims are steered to a fake Ebix hiring portal at hxxps://ebix[.]recruitment-flow[.]com/ (registered via Namecheap, fronted by Cloudflare). After a fake authentication step, the portal serves a '2FA application' as a ZIP archive (TOTPGuard.zip) containing the malware. Lure PDFs (fake Ebix and fake Airbus job descriptions) carry metadata Author 'Jerry' and Creator 'Microsoft Word LTSC'.
EXECUTION — APPDOMAINMANAGER HIJACKING (T1574.014): The ZIP contains three files: setup.exe (a renamed, validly-signed legitimate Microsoft ServiceHub.VSDetouredHost.exe), TOTPGuard.dll (custom AppDomainManager, hidden attribute), and setup.exe.config (modified, hidden attribute). Rather than classic DLL search-order sideloading, the operators set the .NET probing path to the current directory and add binding directives in the .config that cause the CLR to resolve the attacker-controlled assembly named 'TOTPGuard' as the AppDomainManager for the legitimate signed host — execution flows into attacker code under cover of a trusted, signed Microsoft binary.
STAGER (TOTPGuard.dll): On launch, setup.exe shows a functional fake Ebix 2FA generator UI requesting a 'secret key' (input is irrelevant to execution — pure decoy). In the background the stager AES-decrypts an embedded payload using hardcoded key '1234567890123456' and IV 'abcdefghijklmnop', writes it to %AppData%\Roaming\2FAGuard\main.dll, copies setup.exe and setup.exe.config into the same directory, and creates a scheduled task named 'BackupCheck' that runs 'setup.exe doit' at logon. The stager leaks a PDB/development artifact string 'AppDomainInjection' and campaign constants 'MyCompany-Product-TOTP-Salt-2024!@#$', 'TOTPGuardRunner', and 'DailyTrigger'.
NATIVE IMPLANT (main.dll): A 64-bit Windows PE DLL whose single export 'CheckForUpdates' (resolved by ordinal 1) is the entry point. On the 'doit' code path the stager bypasses the 2FA GUI and LoadLibrary-loads main.dll from %AppData%\Roaming\2FAGuard\. The implant performs environmental guardrails (verifies its module name is setup.exe and that the parent process is NOT svchost.exe), anti-analysis (PEB NtGlobalFlag debugger detection, inline anti-debug, control-flow flattening with dynamically computed indirect jumps, opaque predicates, and heavy junk code), and runtime string protection (the related MiniFast lineage uses ROT13 and reversed-string transforms). It is functionally aligned with the actor's MiniFast/MiniBike backdoor family (17-opcode command set: directory listing, file ops, process enumeration, DLL loading, UAC elevation, persistence installation).
C2: The implant beacons over HTTPS to Azure App Service domains (azurewebsites.net) using JSON-formatted API calls and User-Agent 'Mozilla/5.0 ... Chrome/146.0.0.0 Safari/537.36'. Observed routes: POST /rg (initial handshake), POST /agent/init (victim registration), GET /agent/poll?token= (task retrieval), POST /agent/result (result upload), PUT /upload/ (file exfiltration). C2 domains follow a generic 'IT consultants / business checkers / exam joiners' naming pattern. Domains were registered roughly 10 days before the incident; TLS certificates were issued 2026-04-15. Check Point observed the actor abusing SSL.com certificates is
Weaknesses (CWE)
CWE-426, CWE-427, CWE-494, CWE-829
Target sectors: aerospace, defense, aviation, telecommunications
Target regions: Middle East, Europe, Africa, North America
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 38 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1598, T1583, T1583.006, T1588.004, T1566.002, T1204.002, T1204.001, T1053.005, T1574.014, T1574.001