Check Point Tracks Iranian APT Nimbus Manticore Expanding Into Europe With AI-Assisted Malware

Check Point Research reported on May 22 that Nimbus Manticore (UNC1549), an IRGC-affiliated group, ran three campaign waves from February through April 2026 targeting aviation, software, defense, and telecom organizations across the United States, Europe, and the Middle East, activity Check Point tied to the onset of Operation Epic Fury, the U.S. military campaign against Iran launched February 28, 2026 123. The group replaced its MiniJunk toolset with a new backdoor, MiniFast, delivered via AppDomain hijacking; Check Point attributed its modular structure and excessive error handling to AI-assisted development practices, and the group additionally deployed a Trojanized Zoom installer via fake meeting-invitation phishing lures 12. A third wave in April used SEO poisoning, a first for this actor, through a counterfeit SQL Developer download site (getsqldeveloper[.]com) that ranked high on Bing and DuckDuckGo, with campaign files carrying valid SSL.com digital signatures under two certificate names: Gray Matter Software S.R.L. and Kirubel Kerie Negeya 12.