Threat reportMalwareTL-2026-3796
Nimbus Manticore (UNC1549 / Smoke Sandstorm): Iran-backed MiniJunk and MiniBrowse malware with obfuscation, sandbox evasion, DLL sideloading and RPC-based lateral movement
Nimbus Manticore (UNC1549 / Smoke Sandstorm) (TL-2026-3796), also tracked as MiniJunk, is a high-severity malware campaign, first published 2026-10-17. It is attributed to UNC1549 (Iran) with medium confidence, affects Microsoft Windows (64-bit endpoints and enterprise networks), maps to 19 MITRE ATT&CK techniques (T1021, T1027, T1027.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1UNC1549
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3796
- Threat ID
- TL-2026-3796
- Also known as
- MiniJunk, MiniBrowse, Minibike, SlugResin
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- UNC1549
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- aerospace, defense, telecoms, aviation, satellite
- Target regions
- Europe, denmark, sweden, portugal, israel, united arab emirates, Middle East
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Nimbus Manticore (UNC1549 / Smoke Sandstorm)
Malware and tooling: MINIBIKE, MiniBrowse, MiniJunk
How Nimbus Manticore (UNC1549 / Smoke Sandstorm) works
Nimbus Manticore is an Iran-nexus, IRGC-aligned espionage actor (also tracked as UNC1549 and Smoke Sandstorm) that uses heavily obfuscated, code-signed Windows malware against aerospace, defense, telecommunications and aviation targets. Deep Instinct's DIANNA analysis describes a 64-bit PE sample with high-entropy sections, hidden imports, timing-based sandbox detection and RPC impersonation functions, while Check Point documents the MiniJunk backdoor and MiniBrowse stealer delivered through fake recruiter portals and multi-stage DLL sideloading.
Nimbus Manticore is an Iran-nexus cyber-espionage actor assessed as aligned with the Islamic Revolutionary Guard Corps (IRGC). It overlaps with UNC1549 (Mandiant), Smoke Sandstorm and the 'Iranian Dream Job' operations. Mandiant reported the activity (MINIBIKE and MINIBUS backdoors, heavy Azure use) against aerospace, aviation and defense entities in Israel, the UAE and the wider Middle East, active since at least June 2022. Check Point Research (2025-09-22) documented an escalation from early 2025 into Western Europe, specifically defense manufacturing, telecommunications (satellite providers emphasized) and aviation in Denmark, Sweden and Portugal, with continued interest in Israel and the UAE.
Deep Instinct's DIANNA analysis (2025-12-03) examines a 64-bit PE sample compiled with Microsoft Visual C/C++ and the Microsoft Linker. It shows abnormal entropy in the .text section (encoded or compressed code) and high entropy in .data (consistent with encryption). Import hiding is done through GetProcAddress, LoadLibraryA and LoadLibraryExW, so additional components load dynamically at runtime. A non-Windows component named unbcl-new6.dll is referenced. Timing strings (GetSystemTimeAsFileTime, QueryPerformanceCounter, Sleep) point to sandbox and analysis-environment detection. Process/Thread/Start strings indicate payload spawning. RPC strings (RpcAuthIdentityFree, RpcBindingSetAuth*, RpcImpersonateClient) suggest client impersonation for privilege escalation and lateral movement. Deep Instinct states it was the only vendor on VirusTotal that detected and prevented the sample for about a week after the attack was discovered. The Deep Instinct post lists no hashes, IPs or domains, and it does not explicitly tie the sample to the Check Point MiniJunk/MiniBrowse samples. The family and actor naming overlap, but the link is not confirmed by the source.
Check Point's chain starts with spear-phishing, including via LinkedIn and email, from fake HR recruiters who impersonate aerospace and defense firms such as Airbus, Boeing and Rheinmetall. Victims are sent to fake career portals with per-victim credentials and download a ZIP (for example Survey.zip) holding Setup.exe plus sideloading DLLs. Setup.exe sideloads a malicious userenv.dll. A multi-stage chain uses undocumented low-level ntdll calls to modify the DllPath member of RTL_USER_PROCESS_PARAMETERS, which forces the legitimate Windows Defender component SenseSampleUploader.exe to sideload an attacker DLL (xmllite.dll). Files are copied to %AppData%\Local\Microsoft\MigAutoPlay\ (MigAutoPlay.exe is a copy of Setup.exe) and a scheduled task provides persistence. MiniJunk hooks ExitProcess to resist termination.
MiniJunk is an evolution of Minibike (SlugResin). It uses custom-LLVM-style obfuscation: junk code, control-flow obfuscation, opaque predicates, per-string XOR encryption, conditional jumps masked as a single JMP, and arithmetic-obfuscated calls. Binaries are inflated to exceed AV scanning limits, and from May 2025 they are signed with valid SSL.com certificates. It talks HTTPS to 3-5 hardcoded C2 servers using the format ##[parameter]##[command_id]##[argument], with simple encoding (wide string to bytes, then reversed) and no network encryption. Commands: 0 system identifiers, 1 computer name, 2 read and send file, 3 download file from URL, 4 list drives/directories, 5 delete file, 6 execute process with named-pipe output, 7 load DLL, 10 move/rename file. MiniBrowse is a lightweight Chrome/Edge credential stealer injected into browser processes that communicates over named pipes. A separate cluster (dxgi.dll loader, single-byte XOR 0x55, WinHTTP) targets Israeli telecommunications and shares code with MiniJunk. C2 was re-architected around June 2025 to Cloudflare plus Azure App Service (azurewebsites.net), with Google Cloud also abused.
Defenders should hunt for DLL loads from non-standard paths (userenv.dll, xmllite.dll, dxgi.dll), SenseSampleUploader.exe or Setup.exe running from user-writable directories, the MigAutoPlay directory and scheduled tasks, anomalous azurewebsites.net traffic, and recruiter-themed phishing. No CVEs are involved. Severity is analyst-assigned from nation-state attribution.
MITRE ATT&CK techniques used in TL-2026-3796
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1027.001 Binary Padding; T1055 Process Injection; T1070.004 File Deletion; T1497.003 Time Based Checks
Persistence
Command and Control
T1071.001 Web Protocols; T1132.002 Non-Standard Encoding
Discovery
T1082 System Information Discovery
Execution
T1106 Native API; T1204.002 Malicious File
Privilege Escalation
T1134 Access Token Manipulation
defense-impairment
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
stealth
Resource Development
Affected products and versions in Nimbus Manticore (UNC1549 / Smoke Sandstorm)
- Microsoft — Windows (64-bit endpoints and enterprise networks)
Vulnerable versions: Not version-specific; abuses DLL search/sideloading behavior and legitimate Windows Defender component SenseSampleUploader.exe
Remediation for Nimbus Manticore (UNC1549 / Smoke Sandstorm)
Immediate actions
- Hunt for %AppData%\Local\Microsoft\MigAutoPlay\ and MigAutoPlay.exe, and scheduled tasks launching from that path
- Block and alert on outbound HTTPS to the listed azurewebsites.net C2 hosts and recruiter-themed lure domains
- Search EDR for userenv.dll, xmllite.dll or dxgi.dll loaded from user-writable paths by Setup.exe or SenseSampleUploader.exe
- Block the listed SHA-256 hashes and review Chrome/Edge credential exposure on affected hosts; reset exposed credentials
Workarounds
- Restrict archive execution from downloads; enforce web filtering on newly registered career-themed domains
Longer-term hardening
- Block executable and DLL execution from %AppData% and %LocalAppData% via application control
- Deploy EDR/prevention with behavioral coverage for dynamic API resolution, timing-based evasion and RPC impersonation
- Train staff in aerospace, defense, telecom and aviation on fake-recruiter and fake career-portal lures
- Monitor for abnormal NT API manipulation of RTL_USER_PROCESS_PARAMETERS and DLL sideloading into Defender components
Timeline of Nimbus Manticore (UNC1549 / Smoke Sandstorm)
- Suspected Iranian UNC1549 activity (later overlapping with Nimbus Manticore) begins against Middle East aerospace and defense targets using the Minibike backdoor; Mandiant reports activity since at least June 2022 (month approximate).
- Mandiant publishes analysis of UNC1549 targeting Israel, UAE and the Middle East with MINIBIKE and MINIBUS backdoors and extensive Azure infrastructure.
- Actor begins signing MiniJunk samples with valid SSL.com code-signing certificates (month approximate, May 2025 onwards per Check Point).
- C2 infrastructure re-architected to Cloudflare plus Azure App Service during the Israel-Iran conflict; MiniJunk deployed in the period (month approximate).
- Check Point Research publishes Nimbus Manticore campaign analysis: MiniJunk backdoor, MiniBrowse stealer, multi-stage DLL sideloading and fake-recruiter lures targeting Denmark, Sweden and Portugal.
- Deep Instinct publishes DIANNA analysis of a Nimbus Manticore 64-bit PE sample (high entropy, hidden imports, sandbox detection, RPC impersonation), stating it was the only VirusTotal vendor to detect and prevent it for about a week.
Sources cited for Nimbus Manticore (UNC1549 / Smoke Sandstorm)
- DIANNA Explains 4: Nimbus Manticore - Monstrous Malware
- Nimbus Manticore Deploys New Malware Targeting Europe
- Iran-Linked Hackers Target Europe With New Malware
- Nimbus Manticore's Evolving Cyberespionage Campaign
- From the Middle East to Europe: Nimbus Manticore's Expanding Cyber-Espionage Operations
- Suspected Iranian Actor UNC1549 Targets Israel and Middle East
- Iran Targets Job-Seeking European Aerospace Engineers
Detection coverage for TL-2026-3796
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3796 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.