Kaspersky researchers, who are tracking the activity, observed the group employing a social engineering lure centered on fake job recruitment. The attackers pose as potential employers and send coding test challenges to targets, a tactic designed to trick victims into executing malicious payloads under the guise of a legitimate technical assessment. This approach suggests a shift toward more targeted, strategic intrusions rather than broad, indiscriminate attacks.

The technical details surrounding the two new RAT families indicate a deliberate investment in cross-platform compatibility, likely to broaden the group's targeting footprint. While the full scope of the campaign's victims is not yet public, the use of Node.js and JavaScript allows the malware to run seamlessly across operating systems, complicating detection efforts for security teams that may not have visibility into malicious scripts on non-Windows endpoints.

Key takeaways from the analysis include:

• The threat actor, Nimbus Manticore, is now attributed to campaigns using cross-platform RATs written in Node.js and JavaScript.
• Infection chains begin with phishing or social engineering lures, specifically themed around recruitment and coding tests.
• The new malware families extend the group's reach to Linux and macOS systems, in addition to their previous Windows-focused operations.
• The activity was documented by Kaspersky, though no specific CVE identifiers or patch numbers were mentioned in the initial reporting.

Affected organizations should prioritize monitoring for suspicious Node.js processes and review any unsolicited recruitment messages that request the download or execution of coding challenge files, as these may be initial infection vectors.

Source: The Hacker News

Does your security operations center actively monitor for malicious Node.js or JavaScript execution on Linux and macOS endpoints, or is that visibility still a blind spot in your environment?