Nimbus Manticore — tracked by Google/Mandiant as UNC1549 and by Microsoft as Smoke Sandstorm — is an Iran-nexus (IRGC-affiliated) espionage actor that resurfaced during the Iranian conflict (Operation Epic Fury, the US military campaign against Iran launched 2026-02-28). This campaign, documented by Nextron Systems on 2026-06-01 and contextualized by Check Point Research on 2026-05-22, is a material escalation over the actor's earlier SQL Developer SEO-poisoning operation (TL-2026-0581): it introduces a new recruitment-portal initial-access vector and a new TOTPGuard.dll -> main.dll loader/implant pair.

INITIAL ACCESS & SOCIAL ENGINEERING: Operators impersonate recruiters on LinkedIn, dangling high-value (~$200,000 USD) aerospace/defense positions. Victims are steered to a fake Ebix hiring portal at hxxps://ebix[.]recruitment-flow[.]com/ (registered via Namecheap, fronted by Cloudflare). After a fake authentication step, the portal serves a '2FA application' as a ZIP archive (TOTPGuard.zip) containing the malware. Lure PDFs (fake Ebix and fake Airbus job descriptions) carry metadata Author 'Jerry' and Creator 'Microsoft Word LTSC'.

EXECUTION — APPDOMAINMANAGER HIJACKING (T1574.014): The ZIP contains three files: setup.exe (a renamed, validly-signed legitimate Microsoft ServiceHub.VSDetouredHost.exe), TOTPGuard.dll (custom AppDomainManager, hidden attribute), and setup.exe.config (modified, hidden attribute). Rather than classic DLL search-order sideloading, the operators set the .NET probing path to the current directory and add binding directives in the .config that cause the CLR to resolve the attacker-controlled assembly named 'TOTPGuard' as the AppDomainManager for the legitimate signed host — execution flows into attacker code under cover of a trusted, signed Microsoft binary.

STAGER (TOTPGuard.dll): On launch, setup.exe shows a functional fake Ebix 2FA generator UI requesting a 'secret key' (input is irrelevant to execution — pure decoy). In the background the stager AES-decrypts an embedded payload using hardcoded key '1234567890123456' and IV 'abcdefghijklmnop', writes it to %AppData%\Roaming\2FAGuard\main.dll, copies setup.exe and setup.exe.config into the same directory, and creates a scheduled task named 'BackupCheck' that runs 'setup.exe doit' at logon. The stager leaks a PDB/development artifact string 'AppDomainInjection' and campaign constants 'MyCompany-Product-TOTP-Salt-2024!@#$', 'TOTPGuardRunner', and 'DailyTrigger'.

NATIVE IMPLANT (main.dll): A 64-bit Windows PE DLL whose single export 'CheckForUpdates' (resolved by ordinal 1) is the entry point. On the 'doit' code path the stager bypasses the 2FA GUI and LoadLibrary-loads main.dll from %AppData%\Roaming\2FAGuard\. The implant performs environmental guardrails (verifies its module name is setup.exe and that the parent process is NOT svchost.exe), anti-analysis (PEB NtGlobalFlag debugger detection, inline anti-debug, control-flow flattening with dynamically computed indirect jumps, opaque predicates, and heavy junk code), and runtime string protection (the related MiniFast lineage uses ROT13 and reversed-string transforms). It is functionally aligned with the actor's MiniFast/MiniBike backdoor family (17-opcode command set: directory listing, file ops, process enumeration, DLL loading, UAC elevation, persistence installation).

C2: The implant beacons over HTTPS to Azure App Service domains (azurewebsites.net) using JSON-formatted API calls and User-Agent 'Mozilla/5.0 ... Chrome/146.0.0.0 Safari/537.36'. Observed routes: POST /rg (initial handshake), POST /agent/init (victim registration), GET /agent/poll?token= (task retrieval), POST /agent/result (result upload), PUT /upload/ (file exfiltration). C2 domains follow a generic 'IT consultants / business checkers / exam joiners' naming pattern. Domains were registered roughly 10 days before the incident; TLS certificates were issued 2026-04-15. Check Point observed the actor abusing SSL.com certificates issued to 'Gray Matter Software S.R.L.' and 'Kirubel Kerie Negeya' across related infrastructure. Both vendors note strong indications of AI-assisted malware development (excessive error handling, verbose identifiers, modular organization, detailed error strings).

IMPACT: Successful compromise yields persistent, signed-binary-cloaked remote access on aerospace/defense engineering endpoints, enabling espionage-grade collection, file exfiltration, and follow-on tasking against sensitive defense programs in the Middle East and Europe.