Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
Iranian threat group Nimbus Manticore (also tracked as Iranian Dream Job) has developed two new cross-platform RATs, NodeRabbit and PollCat, written in Node.js and JavaScript, expanding their targeting to Linux and macOS systems The malware is delivered via spear-phishing recruitment lures on LinkedIn and job platforms, using trojanized coding challenge archives that trick software engineers into executing malicious code under the guise of technical assessments NodeRabbit communicates with Azure
Analysis
TL;DR
- Iranian threat group Nimbus Manticore (also tracked as Iranian Dream Job) has developed two new cross-platform RATs, NodeRabbit and PollCat, written in Node.js and JavaScript, expanding their targeting to Linux and macOS systems
- The malware is delivered via spear-phishing recruitment lures on LinkedIn and job platforms, using trojanized coding challenge archives that trick software engineers into executing malicious code under the guise of technical assessments
- NodeRabbit communicates with Azure-hosted C2 infrastructure through three API endpoints and supports 11 commands including shell execution, file operations, network enumeration, and Base64-encoded script execution with anti-analysis and proxy support
- The group is rapidly expanding its malware arsenal, adding tools like NightLedger, BridgeHead, ArcBridge, and reverse SSH tunnelers, marking a strategic shift from Windows-only C/C++/Go malware to cross-platform JavaScript-based infections
Why It Matters
This represents a significant evolution in nation-state threat actor tactics, as Nimbus Manticore transitions from Windows-centric tooling to cross-platform RATs, dramatically expanding the potential attack surface beyond traditional Windows targets to include Linux servers and macOS workstations. The use of recruitment-themed social engineering through coding challenges is particularly insidious because it targets technical professionals who are likely to execute unfamiliar code as part of their job application process, making detection by conventional security awareness training more difficult.
Technical Details
- NodeRabbit and PollCat are cross-platform RATs built with Node.js and JavaScript, distributed through trojanized npm packages (
colorized_terminalv2.1.0 andpretty-logv2.1.0) bundled inside coding challenge ZIP archives rather than published to the npm registry - C2 infrastructure uses three Azure-hosted domains (
plugplay.azurewebsites.net,rgbteller.azurewebsites.net,wslwebui.azurewebsites.net) with API endpoints/api/rabbit/checkin,/api/rabbit/task, and/api/rabbit/resultfor agent registration, command polling, and result exfiltration - Three variants of NodeRabbit were identified: the first uses
colorized_terminaland mimics Microsoft Edge updates for persistence; the second usespretty-logwith anti-sandbox detection and partial proxy support; the third uses alternative C2 endpoints (/sdk/v2/ready,/sdk/v2/config,/sdk/v2/events) and adds 12 new commands including WSL integration, Outlook OST/PST harvesting, and fake VS Code extension installation - Persistence mechanisms are OS-aware: Windows Run registry keys, Linux cron entries, macOS launch agents, and WSL-based scheduled tasks, with some variants impersonating legitimate software like Intel Driver & Support Assistant
- Key capabilities include arbitrary shell execution, file read/write with Base64 encoding, process management, network enumeration (adapters, MAC, IP, DNS), beacon interval adjustment, C2 server replacement, and Git repository discovery in development environments
Industry Insight
- Security teams should update detection rules to flag suspicious npm package imports in coding challenge archives and monitor for unusual Node.js processes executing from
.cachedirectories or running detached background processes on employee workstations - Organizations conducting technical recruiting should implement strict verification protocols for coding challenges, including scanning submitted archives for trojanized dependencies, restricting execution environments to sandboxed containers, and explicitly prohibiting candidates from running unverified code without IT review
- The shift toward cross-platform JavaScript-based malware by state-sponsored actors signals a broader trend that will likely continue as attackers recognize the growing prevalence of Linux and macOS in enterprise and development environments, necessitating updated endpoint detection and response strategies beyond traditional Windows-focused defenses
Disclaimer: The above content is generated by AI and is for reference only.