Nimbus Manticore Deploys NightLedger Backdoor, Turning Victim Machines Into Covert WebSocket Relays
What Happened — The Iranian state‑backed group Nimbus Manticore (also known as GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, UNC1549) has been observed delivering a previously undocumented Windows backdoor called NightLedger. The payload installs two custom WebSocket tunnelers that transform compromised hosts into low‑profile relays for command‑and‑control traffic and data exfiltration across the Middle East, Africa, and South Asia.
Why It Matters for Compliance & Audit Readiness
- The scenario exemplifies a failure in access‑control enforcement and monitoring – a core SOC 2 CC6.1 control that requires organizations to limit and log privileged access to systems.
- Continuous evidence of “who accessed what, when, and why” is essential to detect covert relays; without it, audit evidence gaps can arise during a SOC 2 assessment.
- Verisq’s SOC 2 Access Controls capability helps automate policy enforcement, real‑time session logging, and evidence collection to demonstrate compliance with the “Logical Access” trust criteria.
Who Is Affected – Enterprises operating in high‑risk regions (financial services, telecom, government, and critical infrastructure) that run Windows workloads and expose web‑facing services.
Recommended Actions
- Review and tighten privileged‑access policies for all Windows endpoints; enforce least‑privilege and MFA for admin accounts.
- Deploy continuous endpoint monitoring that captures process creation, network connections, and WebSocket traffic anomalies.
- Validate that audit logs are immutable, centrally aggregated, and retained per SOC 2 requirements.
- Conduct a tabletop exercise to test detection and response to covert relay activity.
Source: The Hacker News
Technical Notes
- Attack vector: Malware – custom Windows backdoor (NightLedger) with WebSocket tunneling.
- Data types at risk: System credentials, internal network traffic, potentially exfiltrated business data.
- No public CVE; the backdoor is “undocumented” and likely leverages native Windows APIs to evade AV.