Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
Summary
The Iranian Nimbus Manticore hacking group is reportedly using two new malware families to deliver cross-platform RATs written in Node.js and JavaScript. These new tools are designed to infect Linux and Apple macOS systems, expanding the group's potential targeting capabilities.
IFF Assessment
The discovery of new cross-platform malware families used by a known threat actor indicates an increased risk to a wider range of systems and users.
Defender Context
Defenders should be aware of this evolving threat actor and their use of cross-platform RATs. Organizations with Linux and macOS environments should bolster their defenses against sophisticated social engineering tactics like impersonating recruiters, and ensure their endpoint detection and response (EDR) solutions are capable of identifying these novel Node.js and JavaScript-based threats.