Case checkpoint-nimbus-manticore-minifastState actor AI opsWorldwide
Nimbus Manticore's MiniFast backdoor shows AI-assisted coding during Iran conflict
Check Point tracked three Nimbus Manticore waves from February to April 2026 delivering the new MiniFast backdoor via job lures, trojanized Zoom installers and SEO poisoning, with code traits of LLM-assisted development.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- May 22, 2026
- Location
- Worldwide
- Target
- Aviation, defence, telecom and government in US and Mideast
- Severity
- High
- Triggered by
- Nimbus Manticore (UNC1549)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Check Point tracked three Nimbus Manticore waves from February to April 2026 delivering the new MiniFast backdoor via job lures, trojanized Zoom installers and SEO poisoning, with code traits of LLM-assisted development.
Impact: Long-term access backdoors deployed against aviation and defence targets; victim count not disclosed.
Who triggered it
Actor: Nimbus Manticore (UNC1549)
Attribution: Check Point attributes to IRGC-affiliated Nimbus Manticore; AI assistance assessed from verbose error handling, descriptive naming and debug strings.
Motive: Espionage and access during Operation Epic Fury
How it happened
Attack vector: Career-themed ZIPs with signed host binaries and AppDomain hijacking, trojanized Zoom installers hijacking the update task, SEO-poisoned fake download site
Root cause: AI tooling cut development time, letting the actor roll out new loaders and MiniFast during the conflict
Timeline
- Wave 1 Rising Tension uses AppDomain hijacking and MiniJunk
- Operation Epic Fury begins; wave 2 introduces MiniFast via Zoom installers
- Post-ceasefire SEO poisoning via getsqldeveloper site
- Check Point publishes report
Response
Check Point published IOCs; SSL.com-issued signing certificates abused.
Current status: Ongoing
Sources (open in a new tab)
- Check Point Research research.checkpoint.com
- PolySwarm blog.polyswarm.io
- The Hacker News thehackernews.com
Cite this case
Nimbus Manticore's MiniFast backdoor shows AI-assisted coding during Iran conflict. AI Threat Watch, case checkpoint-nimbus-manticore-minifast, May 22, 2026. https://aithreat.io/cases/checkpoint-nimbus-manticore-minifast/
Permanent link: https://aithreat.io/cases/checkpoint-nimbus-manticore-minifast/