Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

1. Executive summary

The Iranian-aligned actor tracked as Nimbus Manticore (also tracked as "Iranian Dream Job") has been attributed to two previously undocumented cross-platform RAT families, NodeRabbit and PollCat, both built in Node.js/JavaScript and both delivered via trojanized coding-challenge archives distributed through LinkedIn and other job-search platforms. This materially expands the actor's reach from its historical Windows-only C/C++/Go toolset onto Linux and macOS endpoints — a blind spot for many financial-services estates where developer workstations are non-Windows. Attribution rests on a single vendor (Kaspersky) and the actor has no MITRE ATT&CK profile in our verified reference data; treat it as unconfirmed. The immediate risk to EMEA financial services is developer and engineering staff being socially engineered into executing malicious npm-bundled code on corporate or BYOD machines, with the implant providing full shell command execution and file read/write capability.

2. Regulatory framing

No other article in the regulatory reference is specifically engaged by the facts of this item.

3. Technical analysis & attack chain

Attribution caveat: Nimbus Manticore has no MITRE ATT&CK profile in Adverse Trace's verified reference data, and the attribution of NodeRabbit/PollCat to this actor is single-sourced (Kaspersky). Treat attribution as unconfirmed; the technical indicators below stand on their own regardless of actor identity.

Confirmed attack chain (per Kaspersky reporting)

1. Initial access — recruitment social engineering. The threat actor masquerades as a talent-acquisition specialist at a major technology company and approaches a software engineer via LinkedIn or another job-search platform, inviting them to complete a technical assignment for an engineering role.
2. Payload delivery — trojanized coding challenge. The victim receives a ZIP archive, Front-Technical-Challenge.zip, hosted on AWS. The archive contains source code for a project-management tool called Taskflow.
3. Social-engineering hardening of the lure. Instructions tell the candidate to "find and fix all bugs in the frontend code" within three hours and without AI-assisted tools, and explicitly instruct them not to modify server.js, claiming it is "bug-free and functions correctly." The time pressure and the "don't touch the server file" instruction are deliberate measures to steer the victim past the malicious component.
4. Execution — trojanized npm dependency. The first line of server.js imports a trojanized npm package, colorized_terminal version 2.1.0. Critically, the package is bundled directly in the archive's node_modules directory rather than published to the npm registry — so it never passes any registry-side scrutiny, and a casual npm install audit would not flag it as an unknown-registry package.
5. Implant launch. On import, the package silently launches the implant from node_modules/.cache/.320697f1/index.js as a detached background process — surviving the closure of the terminal or Node process that spawned it.
6. C2 communication. NodeRabbit beacons to one of three Azure-hosted C2 addresses (plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, wslwebui.azurewebsites[.]net) via three API endpoints: - /api/rabbit/checkin — registers agent and host information - /api/rabbit/task — polls for commands - /api/rabbit/result — returns task results
7. Post-exploitation capability. The RAT supports 11 commands, including: host detail gathering; running-process listing; arbitrary shell command execution; directory enumeration; chunked file read with Base64-encoded exfiltration; Base64 decode-and-write at a chosen file offset (enabling surgical file modification); file deletion / recursive directory deletion; recursive directory creation; and enumeration of network adapters, MAC addresses, IP addresses and DNS settings. Reporting also references an ability to alter beacon (configuration) behaviour.

Second family — PollCat. Kaspersky tracks a second, previously undocumented cross-platform RAT, PollCat, written in obfuscated JavaScript and likewise distributed through trojanized coding-challenge archives. The source material provides no further technical detail on PollCat's C2 or command set; do not assume parity with NodeRabbit.

Context on the actor's toolset expansion. Kaspersky assesses this is part of a rapid recent expansion of Nimbus Manticore's arsenal, which now includes: a Windows backdoor called NightLedger; two custom WebSocket tunnelers, BridgeHead and ArcBridge; a reverse SSH tunneling tool; and a backdoor sharing overlaps with TWOSTROKE. Historically the actor used C, C++ and Go malware on Windows with DLL search-order hijacking for deployment. The Node.js/JavaScript shift is the new development enabling Linux and macOS targeting. All of this context is single-sourced to Kaspersky.

Geographic observations: first NodeRabbit sample discovered on a system in Afghanistan, with subsequent sightings on two machines in Egypt and Ethiopia. No EMEA financial-services victim is identified in the source material; the sector risk is prospective, based on the actor's recruitment-lure tradecraft and cross-platform reach.

4. Mitigation & containment

P1 — within 24 hours

• Hunt for the implant path and package. Search endpoints (Windows, Linux, macOS) for: node_modules/.cache/.320697f1/index.js, the package name colorized_terminal (any version, especially 2.1.0), and the archive name Front-Technical-Challenge.zip. Any hit is a confirmed-compromise candidate: isolate the host and begin incident response.
• Block the C2 domains at DNS resolver, proxy and egress firewall: plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, wslwebui.azurewebsites[.]net. Note these are Azure App Service (azurewebsites.net) subdomains — if blanket blocking of *.azurewebsites[.]net is operationally unacceptable, block the three FQDNs specifically and alert on any Node.js process initiating HTTPS to *.azurewebsites[.]net paths matching /api/rabbit/*.
• Alert on the C2 URI pattern. Any outbound request containing /api/rabbit/checkin, /api/rabbit/task or /api/rabbit/result is high-confidence malicious.

P2 — within 72 hours

• Brief engineering and recruitment-facing staff. The lure targets software engineers via LinkedIn job approaches. Communicate the specific tradecraft: unsolicited recruiter contact → coding challenge ZIP → "fix frontend bugs in 3 hours, no AI, don't touch server.js." Instruct staff to route any technical challenge involving third-party archives through security review before execution.
• Review developer dependency controls. This package was bundled in node_modules rather than pulled from the npm registry. Ensure: (a) projects from untrusted sources are opened in isolated dev containers/VMs, never on corporate endpoints; (b) CI and local tooling flag node_modules contents that do not match the lockfile or do not exist in the configured registry; (c) npm is configured against an allow-listed internal registry proxy where feasible.
• Audit Node.js detached-process behaviour. The implant runs as a detached background process spawned from a Node import. Tune EDR to alert on Node.js (node/node.exe) spawning long-lived detached child processes from paths under node_modules/.cache/.

P3 — within 7 days

• Extend monitoring to Linux and macOS fleets. The significance of this campaign is cross-platform reach. Confirm your EDR/telemetry coverage actually instruments non-Windows developer endpoints; if not, remediate the gap.
• Incorporate the lure pattern into phishing/social-engineering training, specifically for technical staff, covering recruitment-themed approaches (the same tradecraft family as the Lazarus Group's "Operation Dream Job" style campaigns).

5. Indicators of compromise

All indicators are single-sourced (Kaspersky reporting via The Hacker News); verify before enforcement actions such as takedowns or legal escalation. No file hashes were provided in the source material.

filename  Front-Technical-Challenge.zip
filename  server.js
filepath  node_modules/.cache/.320697f1/index.js
package  colorized_terminal
domain  plugplay[.]azurewebsites[.]net
domain  rgbteller[.]azurewebsites[.]net
domain  wslwebui[.]azurewebsites[.]net
url-path  /api/rabbit/checkin
url-path  /api/rabbit/task
url-path  /api/rabbit/result

6. Detection

rule NodeRabbit_Implant_Jan2026
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-01"
        reference = "https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html"
        description = "Detects NodeRabbit cross-platform RAT based on C2 endpoint paths and implant path reported by Kaspersky"
    strings:
        $api_checkin = "/api/rabbit/checkin" ascii
        $api_task = "/api/rabbit/task" ascii
        $api_result = "/api/rabbit/result" ascii
        $c2_1 = "plugplay.azurewebsites.net" ascii
        $c2_2 = "rgbteller.azurewebsites.net" ascii
        $c2_3 = "wslwebui.azurewebsites.net" ascii
        $cache_path = ".cache/.320697f1/index.js" ascii
    condition:
        uint16(0) == 0x4d5a or filesize < 5MB
        and 2 of ($api_*)
        or (1 of ($c2_*) and 1 of ($api_*))
        or $cache_path
}

Note: the C2 domains and API paths appear as plaintext strings in the implant's JavaScript; the .cache path string may appear in the trojanized colorized_terminal package loader. Scan JavaScript/Node artefacts and any files matching the challenge archive contents.

title: NodeRabbit RAT C2 Communication via Azure App Service
id: 7a3f2c1e-9b4d-4e8a-a1f6-704d2c5b8e91
status: experimental
description: Detects Node.js process communicating with NodeRabbit C2 endpoints or API paths reported by Kaspersky
references:

    - https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html
author: Adverse Trace
date: 2026/09/01
logsource:
    category: proxy
detection:
    selection_domain:
        cs-host|endswith:

            - 'plugplay.azurewebsites.net'
            - 'rgbteller.azurewebsites.net'
            - 'wslwebui.azurewebsites.net'
    selection_uri:
        cs-uri-stem|contains:

            - '/api/rabbit/checkin'
            - '/api/rabbit/task'
            - '/api/rabbit/result'
    condition: 1 of selection_*
falsepositives:

    - Unlikely; API path pattern is highly specific to this tool
level: high

title: Suspicious Node.js Detached Process from node_modules Cache Path
id: 3c8d1b5f-2e6a-4f90-b7c2-9d4e1a8f3b56
status: experimental
description: Detects Node.js spawning from the node_modules/.cache implant path used by NodeRabbit
references:

    - https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html
author: Adverse Trace
date: 2026/09/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/node'
        CommandLine|contains: 'node_modules/.cache/.320697f1/index.js'
    condition: selection
falsepositives:

    - None expected; path is a hard-coded implant location
level: critical

7. Sources

• The Hacker News — "Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests" — https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html — 2026-09-01 (reporting research by Kaspersky, researcher Omar Amin)

8. Adverse Trace position

This is a significant capability expansion for an actor with a proven recruitment-lure playbook: the move to Node.js/JavaScript cross-platform tooling extends Nimbus Manticore's reach from Windows onto Linux and macOS developer endpoints, which are frequently under-instrumented in financial-services estates. The tradecraft is well-designed — the "don't modify server.js" instruction and the registry-bypassing bundled node_modules package show deliberate evasion of both human review and dependency tooling. Attribution to Nimbus Manticore is unconfirmed (no MITRE ATT&CK profile in our verified reference data) and the entire technical dataset is single-sourced to Kaspersky; we assess the indicators themselves as high-confidence for detection purposes but recommend independent verification before any enforcement action. For EMEA financial services clients, the exposure is concentrated in engineering and technology hiring pipelines: clients with active developer recruitment, outsourced coding assessments, or permissive local Node.js execution policies should treat this as a live targeting vector. Adverse Trace will monitor for corroborating reporting on PollCat's command set and C2 infrastructure, additional NodeRabbit samples, and any EMEA-sector victims, and will update this advisory if multi-source confirmation of the attribution or new indicators emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.