Nimbus Manticore Uses Fake Ebix Recruitment Portal to Deliver Custom Malware

Nimbus Manticore, an Iran-nexus threat group also tracked as UNC1549 and Smoke Sandstorm, has been linked to a targeted fake recruitment campaign that delivered custom malware through a polished hiring portal. The campaign used LinkedIn outreach, a fake Ebix-branded recruitment site, and a two-factor authentication lure to infect victims with a multi-stage sideloading chain.

Nextron Systems said it identified the activity during an incident response investigation and attributed it to Nimbus Manticore. The group primarily targets aerospace and defense organizations in the Middle East and Europe, and its operators often use fake job opportunities to approach selected employees.

The attackers impersonated a recruiter for Ebix, a legitimate company in the insurance, banking, and business process outsourcing sector. Ebix was not involved in the operation. Its brand was abused to make the fake hiring process look credible.

Fake LinkedIn recruiter led victims to a fake Ebix portal

The campaign started on LinkedIn, where the attackers used a well-prepared recruiter persona. The lure promised a $200,000 salary and sent the target a branded job description, which helped make the offer look more realistic.

The victim then received temporary login credentials for a fake hiring portal hosted at ebix[.]recruitment-flow[.]com. The site showed Ebix-style branding and did not serve malware unless the visitor had valid credentials, which reduced exposure to researchers and automated scanners.

This tradecraft matches earlier Nimbus Manticore activity documented by Check Point Research, which described targeted HR-themed phishing, fake career portals, unique URLs, and controlled access to malicious downloads. The group has used similar lures against defense, aviation, telecommunications, and related sectors.

Campaign element	Details
Threat actor	Nimbus Manticore, also tracked as UNC1549 and Smoke Sandstorm
Attribution	Iran-nexus activity linked to aerospace and defense targeting
Initial contact	LinkedIn recruiter impersonation
Lure brand	Fake Ebix recruitment process
Delivery method	Fake 2FA application in a ZIP archive
Execution method	AppDomain hijacking through a signed Microsoft component

The fake 2FA app hides the malware chain

After login, the fake portal prompted the victim to download a two-factor authentication application for the supposed hiring process. The downloaded ZIP archive contained three files, although only setup.exe appeared visible by default because the other files carried hidden attributes.

The setup.exe file was a renamed Microsoft Visual Studio component originally known as ServiceHub.VSDetouredHost.exe. Because Microsoft legitimately signed the binary, the first process looked less suspicious during basic inspection.

The attack used a modified setup.exe.config file to force the .NET runtime to load TOTPGuard.dll, an attacker-controlled library. This technique maps to MITRE ATT&CK AppDomainManager hijacking, where adversaries hijack how .NET applications load assemblies to execute malicious code inside a trusted process.

AppDomain hijacking makes the first stage harder to spot

Once the victim ran setup.exe, the malicious TOTPGuard.dll stager loaded inside the signed Microsoft process. The victim saw a fake Ebix-branded interface asking for a secret key, then a working one-time password generator.

That extra realism mattered. Instead of showing an error or closing immediately, the app behaved like a normal security tool and continued the fake hiring workflow. This lowered the chance that the victim would report suspicious behavior right away.

The technique also shows how Nimbus Manticore keeps changing its implementation while preserving the same overall playbook. Check Point Research reported that the group adopted AppDomain hijacking, AI-assisted malware development, and SEO poisoning in more recent 2026 operations.

• The victim receives a fake recruitment message on LinkedIn.
• The attacker sends a branded job description and login credentials.
• The victim signs in to a fake Ebix hiring portal.
• The portal asks the victim to install a fake 2FA app.
• The signed setup.exe file loads a malicious AppDomainManager DLL.
• The stager drops and loads the native implant.

Payload drops into AppData and creates persistence

The stager decrypts an embedded payload with hardcoded AES material and writes the main implant to the user profile. Nextron reported the dropped file path as \AppData\Roaming\2FAGuard\main.dll.

The same stager also copies setup.exe and setup.exe.config into the 2FAGuard directory. It then creates a scheduled task named BackupCheck, which runs at user logon and launches the copied stager with the argument doit.

This behavior fits MITRE ATT&CK Scheduled Task abuse. Attackers often use Windows Task Scheduler to run payloads again after reboot or user login, especially when the task name looks like routine maintenance.

File or artifact	Role
setup.exe	Renamed signed Microsoft Visual Studio component
setup.exe.config	Configuration file that triggers AppDomain hijacking
TOTPGuard.dll	.NET stager loaded by setup.exe
main.dll	Native implant used for C2 and data exfiltration
BackupCheck	Scheduled task used for persistence

Azure-hosted C2 helps traffic blend in

The native implant communicates with command-and-control infrastructure hosted on Azure App Service domains. Microsoft describes Azure App Service as a managed platform for hosting web applications and APIs, which makes traffic to azurewebsites.net less unusual in many business networks.

Nimbus Manticore’s operators used generic, business-themed Azure domains that matched the hiring pretext. That naming pattern can help the infrastructure avoid quick manual detection, especially in environments where Azure cloud traffic is already common.

The group has used trusted applications and cloud infrastructure across multiple campaigns. Google Cloud’s Mandiant has also tracked UNC1549 activity against the aerospace and defense ecosystem, including custom tools, credential theft, and third-party access paths.

The implant uses obfuscation and anti-analysis checks

The native implant checks its execution environment before continuing. Nextron said it verifies its module name and parent process, and it inspects the Process Environment Block for debugger-related flags.

The analyzed sample also used heavier control-flow obfuscation than earlier variants. Researchers observed dynamically calculated indirect jumps, opaque predicates, junk code, and other tricks designed to slow down static analysis.

These changes appear consistent with public reporting on the group’s evolution. Check Point’s 2026 analysis said Nimbus Manticore had adopted new techniques during recent operations, including AppDomain hijacking and faster tooling changes.

Detection and mitigation steps for defenders

Organizations should treat job-related outreach on LinkedIn and similar platforms as part of the phishing risk surface. The campaign shows that targeted social engineering can move far beyond email and still look professional.

Defenders should monitor for AppDomain hijacking indicators, including signed .NET binaries loading unexpected assemblies from the same folder. The MITRE AppDomainManager technique also recommends watching for abnormal module loads, file creation, and configuration changes that alter how .NET applications start.

Security teams should also hunt for suspicious task creation, especially tasks named BackupCheck or tasks that run setup.exe from AppData with the argument doit. The MITRE Scheduled Task entry can help defenders map detection logic for task creation, modification, and execution.

• Restrict execution from AppData, Temp, and other user-writable folders.
• Block or challenge access to newly registered recruitment-themed domains.
• Inspect ZIP archives that contain signed binaries plus hidden DLL or config files.
• Alert on signed .NET binaries loading unexpected AppDomainManager assemblies.
• Monitor scheduled tasks with generic maintenance names and unusual arguments.
• Review outbound traffic to suspicious azurewebsites.net subdomains.
• Train HR, finance, executive, and engineering teams on LinkedIn recruitment lures.

Key IoCs from the campaign

Teams should validate these indicators against their own telemetry and avoid relying on a single IoC alone. Infrastructure may change quickly, but the behavioral chain of fake recruitment, AppDomain hijacking, AppData staging, scheduled task persistence, and Azure-hosted C2 offers stronger hunting value.

Nextron’s report also provides YARA rules for campaign-specific hunting, including rules for the stager, the implant, lure PDFs, and scheduled task artifacts. Those rules can help incident responders scan endpoints and file collections for related samples.

Type	Indicator	Description
SHA-256	620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b	Fake Ebix job description PDF
SHA-256	d1f525eb9347133b92e9558e1413558c8348c0f35a62577f60a5192ba38eb776	TOTPGuard.zip
SHA-256	8e5fc0998838559ca8611e6c03fd998a17ffc2eade24715b2fc3e723c712eb8b	setup.exe.config
SHA-256	eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71	TOTPGuard.dll stager
SHA-256	dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee	main.dll native implant
Domain	ebix[.]recruitment-flow[.]com	Fake Ebix hiring portal
Domain	globalitconsultants[.]azurewebsites[.]net	Azure-hosted C2 domain
Domain	globalbusiness-checkers-it[.]azurewebsites[.]net	Azure-hosted C2 domain
Domain	global-it-consultants[.]azurewebsites[.]net	Azure-hosted C2 domain
File path	\AppData\Roaming\2FAGuard\main.dll	Dropped native implant path
Scheduled task	BackupCheck	Persistence task created by the stager

Why this campaign matters

The campaign shows how Nimbus Manticore blends old and new tradecraft. The social engineering follows the group’s long-running fake job pattern, but the technical chain adds AppDomain hijacking, stronger obfuscation, and a realistic fake 2FA workflow.

Its use of Azure App Service infrastructure also gives defenders a familiar challenge. Cloud-hosted C2 may look like routine web traffic unless teams combine domain age, process context, URL patterns, and endpoint telemetry.

The broader Mandiant UNC1549 research and earlier Check Point findings show that this actor keeps returning to high-value sectors with tailored lures. Security teams in aerospace, defense, telecommunications, software, finance, and executive support roles should treat unexpected recruitment portals as a serious risk signal.

FAQ