Executive Summary
The IRGC-affiliated threat actor Nimbus Manticore (also known as UNC1549) has resurfaced with a sophisticated campaign termed 'Operation Epic Fury,' specifically targeting aviation and software organizations in the US, Europe, and the Middle East. The actor demonstrated significant technical evolution by incorporating AI-assisted malware development to rapidly iterate on tooling and maintain operational availability during kinetic conflicts.
The campaign utilized several novel infection vectors, including AppDomain (application domain) hijacking and SEO poisoning, to deliver a previously undocumented backdoor named MiniFast. By abusing legitimate application flows—such as those of Zoom and SQL Developer—the threat actor successfully bypassed traditional defenses and blended malicious activities with legitimate system processes.
This shift in tradecraft indicates an increasing level of sophistication and adaptability for Iranian-nexus actors. The move from career-themed phishing toward search engine manipulation and application-specific hijacking signifies a broader strategic effort to compromise high-value targets in critical infrastructure and technology sectors, requiring immediate defensive attention.