Skip to content
archiveAPT / state · 01 Sep 2026 · 13:08 UTC

Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

last 60 dispatches · spectrum

The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. …

grounded ✓primary source ↗
Early access

Get the next one first.

Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.

bot-protected