Nimbus Manticore Deploys Night Ledger and Turns Victim Systems Into Covert Relays

Summary: The Iranian state-backed group Nimbus Manticore has been tied to new attacks across the Middle East, Africa, and South Asia using a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers, BridgeHead and ArcBridge, according to Kaspersky. Targets include government and SMB environments in Jordan and Tanzania, aviation organizations in Pakistan, telecom companies in Ethiopia, and financial-sector entities in Burkina Faso, with the initial access method still unknown and the group known for job-themed phishing lures and lookalike videoconferencing pages.
What you should know: BridgeHead turns each victim machine into a relay node, so the operator's TCP traffic appears to originate from the victim's own network - meaning a compromised host in Jordan or Pakistan can be used to reach other systems while your logs show only internal traffic.

Read the original at The Hacker News ↗