26/05/2026
🚨 Iranian Threat Group Expands Cyber Operations With New Malware Campaigns
Cybersecurity researchers have uncovered new activity linked to the Iranian state-aligned threat group known as “Nimbus Manticore,” involving the deployment of advanced malware strains including MiniFast and MiniJunk V2.
According to reports, the campaigns targeted organizations across the U.S., Europe, and the Middle East using phishing attacks, fake software installers, and SEO poisoning techniques.
🛑 What was observed:
🎯 Fake Zoom and SQL Developer installers used to spread malware
📩 Phishing lures impersonating aviation and software-related entities
🌐 Malicious websites pushed through search engine manipulation
🧠 Signs of possible AI-assisted malware development
💻 Backdoor capabilities allowing remote command ex*****on and file theft
Researchers say the malware was designed for long-term persistence, giving attackers the ability to execute commands, exfiltrate data, manage files, and deploy additional payloads on compromised systems.
⚠️ Why this matters:
Attackers are no longer relying only on emails and fake attachments. They are now abusing search engines and trusted software downloads to infect victims — making even routine downloads a potential risk.
🔐 Security Tips:
✔️ Download software only from official vendor websites
✔️ Avoid clicking links from unexpected emails or invitations
✔️ Keep endpoint protection and systems updated
✔️ Monitor unusual scheduled tasks and outbound connections
✔️ Use multi-factor authentication whenever possible
Cyber threats continue to evolve rapidly, combining social engineering, malware, and AI-assisted techniques to increase effectiveness.
