Detecting Nimbus Manticore and their sideloading infection chains

Summary

Nimbus Manticore, also tracked as UNC1549, carried out a targeted phishing campaign that used fake recruitment portals to deliver a multi-stage .NET malware chain. The attack abused legitimate Microsoft Visual Studio components together with AppDomain hijacking to load a custom DLL, which then deployed a second-stage DLL and created persistence through a scheduled task. Command-and-control infrastructure was hosted on Azure-based domains. The campaign primarily targeted aerospace and defense organizations across the Middle East and Europe.

Investigation

Researchers reconstructed the full infection chain, starting with the LinkedIn lure and continuing through the ZIP archive, the altered setup.exe.config file, and the encrypted stager. Their analysis revealed abuse of a renamed ServiceHub.VSDetouredHost.exe, the TOTPGuard.dll loader, an AES-encrypted PE header, and a logon-triggered scheduled task named BackupCheck. Network indicators also pointed to several Azure-hosted domains used for command-and-control communications.

Mitigation

Organizations should train employees to spot recruitment-themed social engineering, block or closely monitor newly registered domains, and enforce AppLocker or equivalent controls on user-writable directories. Defenders should also watch for scheduled tasks named BackupCheck or executions using the doit argument. Monitoring for AppDomain hijacking behavior in .NET applications and suspicious traffic to Azure-hosted command-and-control domains is also recommended.

Response

If related activity is detected, isolate the affected endpoint, collect the malicious binaries and scheduled task definition, and block the associated Azure domains as well as the fake recruitment portal. Investigators should perform forensic review of the AppData\2FAGuard folder, remove the persistence task, and hunt for similar activity on other systems using the same YARA signatures. Detection logic should then be updated with the newly identified indicators.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker has obtained a copy of the legitimate Visual Studio setup.exe binary, renamed it to setup.exe (keeping the name unchanged to avoid suspicion), and placed it in a writable directory. They craft a malicious DLL named TOTPGuard.dll that contains the payload. To hijack the AppDomain, they embed the string AppDomainInjection in the PDB path argument. The attacker then launches the executable with the following command line:

  C:Tempsetup.exe /install /doit /dll "C:TempTOTPGuard.dll" /pdb "C:TempAppDomainInjection.pdb"

  This exact invocation satisfies all three CommandLine|contains conditions in the Sigma rule, causing the rule to fire on the ProcessCreate event.

• Regression Test Script:

  # -------------------------------------------------
  # Regression script to trigger the Nimbus Manticore detection
  # -------------------------------------------------
  $exePath   = "C:Tempsetup.exe"
  $dllPath   = "C:TempTOTPGuard.dll"
  $pdbPath   = "C:TempAppDomainInjection.pdb"
  
  # Ensure the files exist (create dummy placeholders for the test)
  New-Item -ItemType File -Path $exePath -Force | Out-Null
  New-Item -ItemType File -Path $dllPath -Force | Out-Null
  New-Item -ItemType File -Path $pdbPath -Force | Out-Null
  
  # Build the malicious command line
  $arguments = @(
      "/install"
      "/doit"
      "/dll `"$dllPath`""
      "/pdb `"$pdbPath`""
  ) -join " "
  
  Write-Host "Launching malicious setup.exe with arguments:"
  Write-Host $arguments
  
  # Execute the process (will terminate immediately as dummy exe does nothing)
  Start-Process -FilePath $exePath -ArgumentList $arguments -PassThru | Out-Null

• Cleanup Commands:

  # -------------------------------------------------
  # Cleanup artifacts created for the regression test
  # -------------------------------------------------
  $paths = @(
      "C:Tempsetup.exe",
      "C:TempTOTPGuard.dll",
      "C:TempAppDomainInjection.pdb"
  )
  
  foreach ($p in $paths) {
      if (Test-Path $p) {
          Remove-Item -Path $p -Force
          Write-Host "Removed $p"
      }
  }