Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning

Iranian state-sponsored threat actor Nimbus Manticore has launched campaigns deploying new backdoors MiniFast and MiniJunk V2 targeting defense, aviation, and software sectors across multiple countries.

• •MiniFast backdoor developed with AI assistance enables remote command execution, file operations, and persistence mechanisms via HTTP communication
• •Three-wave attack campaign from February to April 2026 uses AppDomain hijacking, trojanized installers (Zoom), and SEO poisoning techniques
• •SEO poisoning campaign created fake SQL Developer download page ranked on Bing and DuckDuckGo to distribute weaponized installers without phishing
• •Attacks employ sophisticated social engineering with fake job offers and spoofed video conferencing invitations to target employees
• •