> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests - URL: https://f4n6.co.uk/security-feed/iranian-hackers-pose-as-recruiters-to-deliver-cross-platform-rats-through-coding-tests/ - Published: 2026-09-01T16:11:19.000Z - Updated: 2026-09-01T16:11:19.000Z - Author: Jeff Davies - Tags: #security-feed, Nimbus Manticore ## 1\. Executive summary The Iranian-aligned actor tracked as **Nimbus Manticore** (also tracked as "Iranian Dream Job") has been attributed to two previously undocumented cross-platform RAT families, **NodeRabbit** and **PollCat**, both built in Node.js/JavaScript and both delivered via trojanized coding-challenge archives distributed through LinkedIn and other job-search platforms. This materially expands the actor's reach from its historical Windows-only C/C++/Go toolset onto **Linux and macOS** endpoints — a blind spot for many financial-services estates where developer workstations are non-Windows. Attribution rests on a single vendor (Kaspersky) and the actor has **no MITRE ATT&CK profile** in our verified reference data; treat it as **unconfirmed**. The immediate risk to EMEA financial services is developer and engineering staff being socially engineered into executing malicious npm-bundled code on corporate or BYOD machines, with the implant providing full shell command execution and file read/write capability. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | This campaign is a distinct, named cyber threat (recruitment-lure RAT delivery targeting engineering staff) that clients should classify and log as part of their threat taxonomy, independent of any confirmed incident. | Threat-intelligence ingestion of this campaign should feed the classification process; clients with engineering hiring activity should record exposure assessment. | | NIS2 Art. 21(2)(d): supply chain security measures | The delivery mechanism is a **supply-chain compromise of the developer toolchain**: a trojanized npm package (colorized\_terminal v2.1.0) bundled into a project's node\_modules directory, executed on npm/Node import. | Clients in NIS2 scope must assess developer dependency-handling controls (registry allow-listing, lockfile integrity, node\_modules provenance) as supply-chain security measures, not just endpoint hygiene. | No other article in the regulatory reference is specifically engaged by the facts of this item. ## 3\. Technical analysis & attack chain **Attribution caveat:** Nimbus Manticore has **no MITRE ATT&CK profile** in Adverse Trace's verified reference data, and the attribution of NodeRabbit/PollCat to this actor is **single-sourced (Kaspersky)**. Treat attribution as unconfirmed; the technical indicators below stand on their own regardless of actor identity. ### Confirmed attack chain (per Kaspersky reporting) 1. **Initial access — recruitment social engineering.** The threat actor masquerades as a talent-acquisition specialist at a major technology company and approaches a software engineer via LinkedIn or another job-search platform, inviting them to complete a technical assignment for an engineering role. 2. **Payload delivery — trojanized coding challenge.** The victim receives a ZIP archive, `Front-Technical-Challenge.zip`, hosted on AWS. The archive contains source code for a project-management tool called **Taskflow**. 3. **Social-engineering hardening of the lure.** Instructions tell the candidate to "find and fix all bugs in the frontend code" within **three hours** and **without AI-assisted tools**, and explicitly instruct them **not to modify `server.js`**, claiming it is "bug-free and functions correctly." The time pressure and the "don't touch the server file" instruction are deliberate measures to steer the victim past the malicious component. 4. **Execution — trojanized npm dependency.** The first line of `server.js` imports a trojanized npm package, **`colorized_terminal` version 2.1.0**. Critically, the package is **bundled directly in the archive's `node_modules` directory rather than published to the npm registry** — so it never passes any registry-side scrutiny, and a casual `npm install` audit would not flag it as an unknown-registry package. 5. **Implant launch.** On import, the package silently launches the implant from **`node_modules/.cache/.320697f1/index.js`** as a **detached background process** — surviving the closure of the terminal or Node process that spawned it. 6. **C2 communication.** NodeRabbit beacons to one of **three Azure-hosted C2 addresses** (`plugplay.azurewebsites[.]net`, `rgbteller.azurewebsites[.]net`, `wslwebui.azurewebsites[.]net`) via three API endpoints: - `/api/rabbit/checkin` — registers agent and host information - `/api/rabbit/task` — polls for commands - `/api/rabbit/result` — returns task results 7. **Post-exploitation capability.** The RAT supports **11 commands**, including: host detail gathering; running-process listing; **arbitrary shell command execution**; directory enumeration; **chunked file read with Base64-encoded exfiltration**; Base64 decode-and-write at a chosen file offset (enabling surgical file modification); file deletion / recursive directory deletion; recursive directory creation; and enumeration of network adapters, MAC addresses, IP addresses and DNS settings. Reporting also references an ability to alter beacon (configuration) behaviour. **Second family — PollCat.** Kaspersky tracks a second, previously undocumented cross-platform RAT, **PollCat**, written in **obfuscated JavaScript** and likewise distributed through trojanized coding-challenge archives. The source material provides no further technical detail on PollCat's C2 or command set; do not assume parity with NodeRabbit. **Context on the actor's toolset expansion.** Kaspersky assesses this is part of a rapid recent expansion of Nimbus Manticore's arsenal, which now includes: a Windows backdoor called **NightLedger**; two custom WebSocket tunnelers, **BridgeHead** and **ArcBridge**; a reverse SSH tunneling tool; and a backdoor sharing overlaps with **TWOSTROKE**. Historically the actor used C, C++ and Go malware on Windows with DLL search-order hijacking for deployment. The Node.js/JavaScript shift is the new development enabling Linux and macOS targeting. All of this context is **single-sourced to Kaspersky**. **Geographic observations:** first NodeRabbit sample discovered on a system in **Afghanistan**, with subsequent sightings on two machines in **Egypt** and **Ethiopia**. No EMEA financial-services victim is identified in the source material; the sector risk is prospective, based on the actor's recruitment-lure tradecraft and cross-platform reach. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Hunt for the implant path and package.** Search endpoints (Windows, Linux, macOS) for: `node_modules/.cache/.320697f1/index.js`, the package name `colorized_terminal` (any version, especially 2.1.0), and the archive name `Front-Technical-Challenge.zip`. Any hit is a confirmed-compromise candidate: isolate the host and begin incident response. - **Block the C2 domains** at DNS resolver, proxy and egress firewall: `plugplay.azurewebsites[.]net`, `rgbteller.azurewebsites[.]net`, `wslwebui.azurewebsites[.]net`. Note these are Azure App Service (`azurewebsites.net`) subdomains — if blanket blocking of `*.azurewebsites[.]net` is operationally unacceptable, block the three FQDNs specifically and alert on any Node.js process initiating HTTPS to `*.azurewebsites[.]net` paths matching `/api/rabbit/*`. - **Alert on the C2 URI pattern.** Any outbound request containing `/api/rabbit/checkin`, `/api/rabbit/task` or `/api/rabbit/result` is high-confidence malicious. ### P2 — within 72 hours - **Brief engineering and recruitment-facing staff.** The lure targets software engineers via LinkedIn job approaches. Communicate the specific tradecraft: unsolicited recruiter contact → coding challenge ZIP → "fix frontend bugs in 3 hours, no AI, don't touch server.js." Instruct staff to route any technical challenge involving third-party archives through security review before execution. - **Review developer dependency controls.** This package was bundled in `node_modules` rather than pulled from the npm registry. Ensure: (a) projects from untrusted sources are opened in isolated dev containers/VMs, never on corporate endpoints; (b) CI and local tooling flag `node_modules` contents that do not match the lockfile or do not exist in the configured registry; (c) `npm` is configured against an allow-listed internal registry proxy where feasible. - **Audit Node.js detached-process behaviour.** The implant runs as a detached background process spawned from a Node import. Tune EDR to alert on Node.js (`node`/`node.exe`) spawning long-lived detached child processes from paths under `node_modules/.cache/`. ### P3 — within 7 days - **Extend monitoring to Linux and macOS fleets.** The significance of this campaign is cross-platform reach. Confirm your EDR/telemetry coverage actually instruments non-Windows developer endpoints; if not, remediate the gap. - **Incorporate the lure pattern into phishing/social-engineering training**, specifically for technical staff, covering recruitment-themed approaches (the same tradecraft family as the Lazarus Group's "Operation Dream Job" style campaigns). ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | --------------------------------------- | ---------- | ----------------------------- | | filename | Front-Technical-Challenge.zip | High | Kaspersky via The Hacker News | | filename | server.js | High | Kaspersky via The Hacker News | | filepath | node\_modules/.cache/.320697f1/index.js | High | Kaspersky via The Hacker News | | package | colorized\_terminal (version 2.1.0) | High | Kaspersky via The Hacker News | | domain | plugplay\[.\]azurewebsites\[.\]net | High | Kaspersky via The Hacker News | | domain | rgbteller\[.\]azurewebsites\[.\]net | High | Kaspersky via The Hacker News | | domain | wslwebui\[.\]azurewebsites\[.\]net | High | Kaspersky via The Hacker News | | url-path | /api/rabbit/checkin | High | Kaspersky via The Hacker News | | url-path | /api/rabbit/task | High | Kaspersky via The Hacker News | | url-path | /api/rabbit/result | High | Kaspersky via The Hacker News | All indicators are **single-sourced (Kaspersky reporting via The Hacker News)**; verify before enforcement actions such as takedowns or legal escalation. No file hashes were provided in the source material. ```iocs filename Front-Technical-Challenge.zip filename server.js filepath node_modules/.cache/.320697f1/index.js package colorized_terminal domain plugplay[.]azurewebsites[.]net domain rgbteller[.]azurewebsites[.]net domain wslwebui[.]azurewebsites[.]net url-path /api/rabbit/checkin url-path /api/rabbit/task url-path /api/rabbit/result ``` ## 6\. Detection ```yara rule NodeRabbit_Implant_Jan2026 { meta: author = "Adverse Trace" date = "2026-09-01" reference = "https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html" description = "Detects NodeRabbit cross-platform RAT based on C2 endpoint paths and implant path reported by Kaspersky" strings: $api_checkin = "/api/rabbit/checkin" ascii $api_task = "/api/rabbit/task" ascii $api_result = "/api/rabbit/result" ascii $c2_1 = "plugplay.azurewebsites.net" ascii $c2_2 = "rgbteller.azurewebsites.net" ascii $c2_3 = "wslwebui.azurewebsites.net" ascii $cache_path = ".cache/.320697f1/index.js" ascii condition: uint16(0) == 0x4d5a or filesize < 5MB and 2 of ($api_*) or (1 of ($c2_*) and 1 of ($api_*)) or $cache_path } ``` Note: the C2 domains and API paths appear as plaintext strings in the implant's JavaScript; the `.cache` path string may appear in the trojanized `colorized_terminal` package loader. Scan JavaScript/Node artefacts and any files matching the challenge archive contents. ```yaml title: NodeRabbit RAT C2 Communication via Azure App Service id: 7a3f2c1e-9b4d-4e8a-a1f6-704d2c5b8e91 status: experimental description: Detects Node.js process communicating with NodeRabbit C2 endpoints or API paths reported by Kaspersky references: - https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html author: Adverse Trace date: 2026/09/01 logsource: category: proxy detection: selection_domain: cs-host|endswith: - 'plugplay.azurewebsites.net' - 'rgbteller.azurewebsites.net' - 'wslwebui.azurewebsites.net' selection_uri: cs-uri-stem|contains: - '/api/rabbit/checkin' - '/api/rabbit/task' - '/api/rabbit/result' condition: 1 of selection_* falsepositives: - Unlikely; API path pattern is highly specific to this tool level: high ``` ```yaml title: Suspicious Node.js Detached Process from node_modules Cache Path id: 3c8d1b5f-2e6a-4f90-b7c2-9d4e1a8f3b56 status: experimental description: Detects Node.js spawning from the node_modules/.cache implant path used by NodeRabbit references: - https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html author: Adverse Trace date: 2026/09/01 logsource: category: process_creation product: linux detection: selection: Image|endswith: '/node' CommandLine|contains: 'node_modules/.cache/.320697f1/index.js' condition: selection falsepositives: - None expected; path is a hard-coded implant location level: critical ``` ## 7\. Sources - The Hacker News — "Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests" — https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html — 2026-09-01 (reporting research by Kaspersky, researcher Omar Amin) ## 8\. Adverse Trace position This is a **significant capability expansion** for an actor with a proven recruitment-lure playbook: the move to Node.js/JavaScript cross-platform tooling extends Nimbus Manticore's reach from Windows onto Linux and macOS developer endpoints, which are frequently under-instrumented in financial-services estates. The tradecraft is well-designed — the "don't modify server.js" instruction and the registry-bypassing bundled `node_modules` package show deliberate evasion of both human review and dependency tooling. Attribution to Nimbus Manticore is **unconfirmed** (no MITRE ATT&CK profile in our verified reference data) and the entire technical dataset is **single-sourced to Kaspersky**; we assess the indicators themselves as high-confidence for detection purposes but recommend independent verification before any enforcement action. For EMEA financial services clients, the exposure is concentrated in engineering and technology hiring pipelines: clients with active developer recruitment, outsourced coding assessments, or permissive local Node.js execution policies should treat this as a live targeting vector. Adverse Trace will monitor for corroborating reporting on PollCat's command set and C2 infrastructure, additional NodeRabbit samples, and any EMEA-sector victims, and will update this advisory if multi-source confirmation of the attribution or new indicators emerges. --- [Read the original source →](https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*