# Iranian Cyber Espionage Group Expands Arsenal With Cross-Platform Malware Targeting Developer Workstations
A prominent Iranian cyber espionage operation has significantly broadened its technical capabilities with the introduction of two novel malware families designed to infect systems running Linux and Apple macOS, in addition to Windows. The development signals a strategic shift toward cross-platform remote access trojans (RATs) built with Node.js and JavaScript, allowing the threat actors to deploy a single codebase across multiple operating systems.
## The Shift to Cross-Platform Scripting
Security analysts have documented the emergence of two previously unknown malware strains — now tracked under the names NodeRabbit and PollCat — that represent a marked evolution in the threat actor’s tradecraft. Historically, the group relied on malware written in compiled languages such as C, C++, and Go, and employed techniques like DLL search-order hijacking to deploy their tools. The new cross-platform approach, however, allows operators to maintain one payload that functions seamlessly across Windows, Linux, and macOS environments, blending naturally into the workflows of software developers.
## Delivery Through Fake Job Opportunities
Both malware families share a common infection vector: spear-phishing messages routed through professional networking platforms and job search websites. The attackers adopt the persona of talent acquisition specialists at fictitious or compromised technology companies, reaching out to software engineers with invitations to complete technical assignments as part of a fabricated hiring process. This recruitment-themed luring technique has earned the group an alternate designation in some tracking databases.
In one documented campaign, targets received a ZIP archive titled “Front-Technical-Challenge.zip,” hosted on Amazon Web Services cloud infrastructure. The archive contained source code for a project management application called Taskflow, with instructions directing recipients to debug the frontend code within a strict three-hour window and without the use of AI-assisted coding tools. Critically, the server-side component — a file named “server.js” — was presented as bug-free and untouched, when in reality it harbored the malicious payload.
In a separate campaign utilizing the “RankChallenge-react” lure, the attackers constructed a CTF-style (Capture the Flag) React application, embedding CTF-related terminology throughout the project structure to lend it authenticity. A PDF tutorial bundled within the archive created a sense of urgency, requiring victims to enter a six-digit one-time password that rotated every 30 seconds and complete the challenge within a compressed one-hour session. This time pressure was likely designed to reduce cautious analysis and increase the probability of infection.
## NodeRabbit: Capabilities and Infrastructure
NodeRabbit establishes communication with command-and-control (C2) servers hosted on Microsoft Azure, using three distinct API endpoints for agent registration, command retrieval, and result exfiltration. The malware supports eleven operational commands, including:
– Gathering host system details
– Listing running processes
– Executing arbitrary shell commands
– Enumerating directories and reading files in chunks
– Deleting files and directories recursively
– Enumerating network adapters, MAC addresses, IP addresses, and DNS settings
– Adjusting beacon intervals to evade detection
A particularly insidious feature allows NodeRabbit to write a Base64-encoded Node.js script to a randomly named temporary file, execute it, and then immediately delete it — effectively erasing forensic trails of malicious activity.
The malware achieves persistence through OS-specific mechanisms: a Windows Run registry key on Windows systems, a cron entry on Linux, and a launch agent on macOS. Depending on the variant, persistence is disguised as either a Microsoft Edge browser update or Intel’s Driver & Support Assistant.
Kaspersky security researchers identified two additional variants of NodeRabbit recovered from machines in Egypt and Ethiopia, each exhibiting subtle differences. One variant replaced the initial trojanized npm package with an alternative called “pretty-log” and included defensive measures to terminate itself if run inside a security analysis environment. Another variant used a completely different set of C2 API endpoints and introduced twelve additional commands, including harvesting account credentials from Outlook email storage files, installing a fake VS Code extension for persistence, and injecting launchers into Git repository hooks.
## PollCat: A Parallel Threat
PollCat operates on a similar cross-platform RAT model but is distributed through time-limited developer assessment portals rather than standalone ZIP archives. Like NodeRabbit, it runs independently of the user-facing challenge interface, meaning the malware executes regardless of whether the target successfully completes or fails the coding exercise.
PollCat supports 22 commands and communicates through seven API endpoints, enabling operators to perform file operations, execute shell commands, upload and download files, load dynamic libraries, create and extract archives, and enumerate system resources. Three commands — related to file downloads, privilege escalation, and persistence management — are present in the code but have not yet been implemented.
A notable reconnaissance feature of PollCat involves scanning for folders matching 24 predefined strings associated with major software and cybersecurity vendors, including Google, Microsoft, Palo Alto Networks, Cisco, VMware, Fortinet, CrowdStrike, and others. When matches are found, the malware inventories the root contents and transmits the results back to the C2 server, suggesting targeted intelligence-gathering against organizations in the technology and security sectors.
## Connections to a Broader Campaign
The technical characteristics of both NodeRabbit and PollCat — including their C2 infrastructure, command structures, and beacon timing — bear strong similarities to a previously documented backdoor attributed to the same group. The use of Azure Websites and Cloudflare-proxied domains for C2 communications further reinforces the link.
The broader campaign infrastructure is believed to be associated with an operation known in some intelligence circles by a codename referencing an illusion-themed moniker, which has historically targeted critical sectors across the Middle East and Africa for espionage purposes using LinkedIn-based recruiter personas.
## Frequently Asked Questions (FAQ)
**Q: What is the Iranian Dream Job group?**
A: It is an alternate tracking name for the Iranian threat group also known as Nimbus Manticore. The name derives from the group’s consistent use of recruitment-themed lures to lure victims into executing malware under the pretense of a job opportunity.
**Q: Which operating systems are affected?**
A: The malware is designed to be cross-platform, targeting Windows, Linux, and macOS systems. This allows a single codebase to infect diverse environments commonly found in developer workstations.
**Q: How can organizations defend against these threats?**
A: Organizations should implement email and link filtering for professional networking platforms, conduct security awareness training about social engineering via fake job postings, and employ endpoint detection tools capable of identifying suspicious Node.js and JavaScript execution patterns. Blocking access to known malicious Azure-hosted domains at the network level can also help.
**Q: What makes NodeRabbit and PollCat different from the group’s earlier malware?**
A: Previous malware from this group was written in compiled languages like C, C++, and Go and relied on Windows-specific deployment techniques. The new variants are built with JavaScript and Node.js, making them portable across operating systems and harder to detect on non-Windows platforms.
**Q: Who are the primary targets of this campaign?**
A: The campaign appears to focus on software engineers and developers, particularly those in the Middle East and Africa, with the goal of cyber espionage. Targets are identified through professional networking platforms and job boards.
**Q: Is the malware still actively being developed?**
A: Evidence suggests ongoing development, with multiple variants discovered and unimplemented features still present in the codebase. The group’s expanding toolkit indicates a sustained and growing interest in this threat actor operation.
## Conclusion
The emergence of NodeRabbit and PollCat represents a significant escalation in the capabilities of the Iranian threat group responsible for these attacks. The pivot to cross-platform scripting languages allows the operators to cast a wider net, targeting developer workstations across all major operating systems with a unified codebase. Combined with increasingly sophisticated social engineering lures and the use of legitimate cloud infrastructure for command-and-control communications, this campaign underscores the need for heightened vigilance among technical professionals who may be targeted through seemingly legitimate job opportunities. Organizations must remain proactive in their defensive posture, combining technical controls with user awareness to counter a threat that continues to evolve in both reach and sophistication.
Thank you for reading
