Iran-Linked Hackers Deploy 'NightLedger' Backdoor Against Middle East, Africa Targets

Key points

• An Iranian government-linked hacking crew known as Nimbus Manticore is running a new espionage campaign across the Middle East, Africa, South Asia and beyond.
• The group has deployed a previously unseen Windows backdoor, meaning a hidden program that gives attackers remote control, called NightLedger.
• Two custom WebSocket tunneling tools let the attackers route their traffic through infected machines, making the activity harder to spot.
• The same crew is tracked under several other names: GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail and UNC1549.
• Targets are organisations of interest to Iranian intelligence, not consumers.

Nimbus Manticore, the Iranian state-backed hacking crew, has quietly rolled out a new toolkit against targets spanning the Middle East, Africa, South Asia and neighbouring regions, according to reporting from The Hacker News. It's the same group Mandiant designates UNC1549, which we first covered in May when it was dropping MiniFast and MiniJunk V2 in an aviation phishing wave.

This campaign's headline finding is a Windows backdoor not previously documented in public research, named NightLedger. Alongside it sit two custom tunneling tools built on WebSockets, a common web protocol that keeps a live connection open between two computers.

Those tunnelers turn a hacked machine inside a target organisation into a quiet relay point. Attacker traffic gets folded into normal-looking web sessions, which is why defenders often don't catch it on first pass.

Who is Nimbus Manticore?

It's a hacking group Western researchers link to the Iranian state. The crew focuses on espionage rather than theft or extortion, historically going after aerospace and defence firms as well as telecommunications companies.

The many aliases reflect competing naming conventions across vendors. Microsoft calls it Smoke Sandstorm; Google's Mandiant unit tracks it as UNC1549; Check Point uses Nimbus Manticore. They're describing the same people.

What does the new backdoor actually do?

NightLedger is a remote-control tool for Windows. Once installed, the attackers can issue commands, transfer files and plant further tools without the user knowing.

Backdoors aren't rare. What matters is that NightLedger hasn't appeared in prior public reporting, meaning most security products won't flag it by default. That's the window the operators are counting on, a stretch of quiet access before detection rules catch up.

Why the WebSocket tunnels matter

The two custom tunnelers are arguably the more interesting piece. They push command traffic through infected systems and out to the internet, dressed up as ordinary web sessions.

For a defender reading network logs, that traffic resembles a browser talking to a normal website. The victim's own machine becomes part of the attackers' relay infrastructure. It's a tidy way to hide in plain sight, and it's a technique we've seen Iranian-nexus groups favour in several campaigns this summer.

Should you worry?

The targeting pattern points at governments, defence contractors and telecoms firms rather than ordinary consumers. If you're a nurse or a shop owner, you're almost certainly not on the list.

Staff at exposed organisations should treat unexpected login prompts, recruiter messages on LinkedIn and unusual file attachments with real suspicion. Nimbus Manticore has a history of using fake job offers to lure engineers into opening booby-trapped files.

Security teams should hunt for unusual outbound WebSocket connections and unknown persistent services on Windows endpoints. Public technical indicators from the researchers who found this campaign are the fastest starting point.

The bigger picture: this group keeps refreshing its toolset at a pace that outstrips most detection pipelines. NightLedger is new today; it won't be the last new thing.