Nimbus Manticore: NightLedger backdoor and the BridgeHead / ArcBridge relay tunnelers

On 2026-07-28 Kaspersky GReAT published a previously undocumented malware set attributed to Mirage Kitten, the Iranian state-aligned espionage cluster also tracked as Nimbus Manticore, GalaxyGato, Smoke Sandstorm, Subtle Snail, TA455 and UNC1549. The toolkit is three parts: NightLedger, a Windows backdoor, and two custom WebSocket tunnelers, BridgeHead and ArcBridge. The actor's objective is persistent espionage access to aerospace, aviation, defence, telecommunications, government and financial-sector networks, with confirmed victims in Egypt, Jordan, Tanzania, Pakistan, Ethiopia and Burkina Faso.

The defensively interesting part is the direction of the tunnel. BridgeHead does not dial out to fetch tasking and then act locally. It establishes one outbound HTTPS WebSocket, and from then on the C2 server initiates every tunnel connection, with the implant forwarding traffic between operator-chosen targets and the WebSocket channel. The victim workstation becomes a SOCKS5 relay node: the operator's scanning, SMB access and lateral movement all originate from inside the victim network, from a host that has a legitimate user, a legitimate IP and a legitimate reason to talk to internal servers. Every east-west artefact of the intrusion looks like the compromised employee.

That shapes the hunt. There is exactly one anomalous outbound flow per relay host and it is TLS on 443 to what looks like Azure App Service. Everything else the operator does is internal traffic sourced by a trusted host. So the highest-value detection surface is not the egress, it is the host-side loading artefacts: AppVShNotify.exe running outside its install tree and side-loading a fake SspiCli.dll, and tunneler DLLs (unbcl.dll, libwinpthread-1.dll, IPHLPAPI.dll) dropped into %LocalAppData%\Microsoft\VisualStudio or a VPN client's program directory. Those are cheap to query, low false positive, and they fire before the relay is useful.

Three properties make this actor harder than the usual commodity intrusion. Each BridgeHead binary is tailored per target: it reads the current Windows username, lowercases it, and exits silently unless a hardcoded substring is present, which means a sample pulled from one victim will not detonate in your sandbox and generic dynamic analysis produces nothing. The implant speaks enterprise proxy, handling HTTP 407 by negotiating Negotiate or NTLM with the logged-on user's SSO context, so a proxy that authenticates users does not stop it, it authenticates it. And Kaspersky note a deliberate migration away from Azure subdomain infrastructure toward Cloudflare-backed domains, so today's domain list is the most perishable part of this pack.

Defender priority: hunt the side-load and the drop paths first (Q1 through Q4). They are high-confidence, low-noise, and they catch the intrusion at the stage where it has not yet become internal traffic. Treat the domain lists as supporting evidence only. The azurewebsites.net C2 hosts sit inside a namespace your users legitimately reach all day, so a domain-only rule on that namespace is not a detection, it is a triage queue.

Analyst notes and decisions

• Single-source atomic indicators. Every hash, domain and IP in this pack traces to the Kaspersky report. The two secondary sources reproduce a subset and add nothing new, so corroboration is by republication rather than independent observation. That is normal for a first-disclosure pack, but it means confidence in the indicators should be read as "high, single primary source" and not "multi-source confirmed".
• Kaspersky withheld part of the IOC set for Threat Intelligence Reporting customers. The published list is a subset, so absence of a match here is not absence of the actor.
• Deliberate infrastructure migration. The report explicitly notes a shift away from Azure subdomain infrastructure toward Cloudflare-backed domains. Domain indicators are therefore short-lived. Expiry is set to three months on hunt-tier domains for that reason.
• Hash coverage is MD5-only. No SHA256 was published. Falcon IOC Management accepts MD5, so the CSV is importable, but MD5 is trivially defeated by recompilation and this actor recompiles per target. Behaviour beats hashes here.
• Sector framing was normalised. Kaspersky's victimology paragraph and TechNadu's sector line differ slightly in emphasis. This pack states the union of both, which is what the victim list actually supports.
• Source integrity check. All three fetched pages were scanned for text directed at an automated agent (instructions, claimed authorisations, requests to fetch further URLs or add indicators). None was found. Matches on the string "AI agent" were unrelated headline text in the sites' own sidebars, not content addressed to a reader-agent. No source was dropped.

Attack chain

Hunt hypotheses, ordered by fidelity

All indicators below are published by Kaspersky GReAT (2026-07-28) and are traced verbatim to the saved source snapshot. Hashes are MD5; no SHA256 was published.

Non-atomic indicators (behavioural, no expiry)

Telemetry precondition. If your Falcon deployment excludes %LocalAppData% or VPN vendor directories from file-write monitoring for performance reasons, Q3 and Q4 will return nothing and it will look like a clean result. Confirm those exclusions before you trust a negative outcome from this pack.

The queries in s8 cover what the endpoint sensor sees. These checks cover what it does not: URI paths, WebSocket upgrades, proxy authentication and image-load events. Run them in parallel with the CQL, not after.

7.1 Proxy / TLS-inspecting gateway: NightLedger URI paths

The three NightLedger endpoints are fixed, long, and keyboard-walk random. They will not collide with anything legitimate. Search the last 90 days of proxy logs for the URI path, independent of hostname, because the C2 domain rotates but the paths have not.

URI path contains any of:
  /edfcvfgbhnjmkqwasderfgg     (tasking GET)
  /wsdefvvbnhyuijkplmbgfrtt    (command output POST)
  /qasxcdfvgbhnmyuioplkhnj     (file upload POST)

Any single hit is a confirmed NightLedger infection. Escalate immediately, do not tune.

7.2 Proxy: BridgeHead WebSocket upgrade with a hardcoded stale user agent

BridgeHead's upgrade request carries a fixed Chrome 86 / Edge 86 user agent. Chrome 86 shipped in 2020, so on a managed fleet this string on a WebSocket upgrade is anomalous on its own. Pair the Upgrade: websocket header with a user-agent major version far behind your browser baseline.

Match on the upgrade request:
  Method:      GET
  Path:        /connect
  Header:      Upgrade: websocket
  Header:      Connection: Upgrade
  User-Agent:  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38

Broader, rotation-resistant variant:
  Upgrade: websocket  AND  User-Agent Chrome major version older than your fleet baseline minus 10
  Then group by client host. A managed endpoint should have zero.

7.3 Proxy: SSO authentication from a non-browser client

BridgeHead answers HTTP 407 by querying supported auth schemes, selecting Negotiate (0x10) then NTLM (0x2) in that order, and retrying up to three times with null credentials so Windows supplies the logged-on user's SSO context. Hunt for successful Negotiate or NTLM proxy authentication where the user agent is not a browser your fleet actually runs, or where three 407 retries precede a 101.

7.4 Sysmon Event ID 7 (Image Load): the side-load itself

Falcon's standard event model has no module-load event, so if Sysmon is deployed this is the most direct evidence of the NightLedger chain and it is worth running even on a partial Sysmon estate.

Sysmon EID 7 where
  ImageLoaded  ends with \SspiCli.dll
  AND ImageLoaded does NOT start with C:\Windows\System32\
  AND ImageLoaded does NOT start with C:\Windows\SysWOW64\
  AND ImageLoaded does NOT start with C:\Windows\WinSxS\

Also worth a standing rule:
  Image ends with \AppVShNotify.exe  AND  Signed = false
  Image ends with \AppVShNotify.exe  AND  ImageLoaded is unsigned

7.5 Windows: SACL audit on NetSetup.log

Endpoint file-read telemetry is unreliable (see s5). A filesystem SACL gives an independent, always-on record of who read the file. See playbook P4 for the deployment steps.

Enable: Audit Object Access (Success) via Advanced Audit Policy
Apply SACL: C:\Windows\debug\NetSetup.log, Principal Everyone, Read Data, Success
Then hunt: Security EID 4663, ObjectName = C:\Windows\debug\NetSetup.log
Exclude the process images your domain-join and support tooling actually use.

7.6 DNS server analytic logs

Covers unmanaged hosts that have no Falcon sensor. Query the resolver for the domain list in s10 rather than relying on endpoint DNS events alone. Retain hits for the full 90-day window; the actor's Azure-to-Cloudflare migration means a historical hit may be the only evidence left.

7.7 Mail gateway: the recruitment lure

Hunt inbound mail carrying links to third-party file-sharing services where the message body references a job opportunity, hiring platform, candidate assessment or a videoconference invitation, targeted at staff in aerospace, aviation, defence or telecom functions. The lures impersonate trusted brands, so brand-impersonation scoring plus a file-sharing link is the useful combination, not either alone.

No in-query time filter is used anywhere in this pack. Set the window with the Falcon console time picker. Each query records the intended lookback as a // LOOKBACK: comment. A CQL comparison cannot take an expression on its right-hand side, so an in-query @timestamp filter against now() fails to parse on line 1 and silently kills the whole query.

// HUNT: AppVShNotify.exe running outside the App-V / Office install tree
// MITRE: T1574.001, T1574.002 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, ProcessRollup2
// LOOKBACK: 30d, set in the Falcon console time picker
// FALSE POSITIVES: software packaging and App-V sequencing hosts may stage this binary
// TUNING: exclude your packaging/sequencing build hosts by ComputerName, not by path
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^AppVShNotify\.exe$/i
| ImageFileName!=/microsoft office/i
| ImageFileName!=/microsoft application virtualization/i
| ImageFileName!=/windows\\system32/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=200)

// HUNT: SspiCli.dll dropped outside the Windows system DLL directories
// MITRE: T1574.001, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, PeFileWritten
// LOOKBACK: 30d, set in the Falcon console time picker
// FALSE POSITIVES: SDK and redistributable installers that stage a private copy of the DLL
// TUNING: if a build agent trips this, exclude the specific ContextBaseFileName of the installer, never the whole path
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^sspicli\.dll$/i
| TargetFileName!=/windows\\system32/i
| TargetFileName!=/windows\\syswow64/i
| TargetFileName!=/windows\\winsxs/i
| TargetFileName!=/windows\\servicing/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=200)

// HUNT: BridgeHead / ArcBridge tunneler DLL basenames written outside system dirs
// MITRE: T1036.005, T1105 | CONF: high  FP: medium  COST: low
// REQUIRES: Falcon Windows sensor, PeFileWritten
// LOOKBACK: 30d, set in the Falcon console time picker
// FALSE POSITIVES: libwinpthread-1.dll ships with MinGW-built software; IPHLPAPI.dll is a real Windows DLL
// TUNING: exclude ContextBaseFileName of your known installers (git-installer, msys2, gimp setup, vendor updaters);
// TUNING: keep every unbcl.dll hit regardless of writer, it has no common legitimate use
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^(unbcl\.dll|libwinpthread-1\.dll|iphlpapi\.dll)$/i
| TargetFileName!=/windows\\system32/i
| TargetFileName!=/windows\\syswow64/i
| TargetFileName!=/windows\\winsxs/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ContextBaseFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=300)

// HUNT: PE written into the observed BridgeHead staging directories, any filename
// MITRE: T1105, T1574.001 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, PeFileWritten. Confirm %LocalAppData% is not excluded from file monitoring
// LOOKBACK: 30d, set in the Falcon console time picker
// FALSE POSITIVES: Visual Studio extension and component installers write under the same parent tree
// TUNING: exclude ContextBaseFileName devenv.exe, vs_installer.exe and VSIXInstaller.exe, then review what remains
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/(appdata\\local\\microsoft\\visualstudio|univpn\\promote)/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ContextBaseFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=300)

// HUNT: published NightLedger / BridgeHead / ArcBridge MD5 hashes
// MITRE: T1588.001 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, ProcessRollup2 or PeFileWritten with MD5HashData populated
// LOOKBACK: 90d, set in the Falcon console time picker
// FALSE POSITIVES: none
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| MD5HashData=/^(a239e655709a2518dd0b7bdbed163679|5fa15ef96808ea82f0a6176f0bb4b386|42f847597109da2a220391bb09d00676|afb1c1583606599c7272cfb33cc6f498|6038d42af0affd1fb263f470c0956f6b|ae628efa305387b633dce82f9364875b|f7d36cc5904a53252d2bb3d21615134f|c90f0efadbf322e5eb1c4103a38c30e6|d09b14a2fe01c7363ecc56f5d046162c|c832ecd135781b11f59e3fffb3d2b6ac)$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, TargetFileName, MD5HashData, aid])
| sort(@timestamp, order=desc, limit=200)

// HUNT: DNS resolution of Nimbus Manticore non-Azure C2 and staging domains
// MITRE: T1071.001, T1008, T1568 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, DnsRequest
// LOOKBACK: 90d, set in the Falcon console time picker
// FALSE POSITIVES: none for these specific FQDNs
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(realhealthshop\.com|tjconsultingservices\.com|aecert\.org|businessmixture\.com|global-reds\.com|maadinglobal\.com|neexportfolio\.com|business-deegital\.com|thehealth-life\.com|healthcarezoomcenteral\.org|buisness-centeral-transportation\.com)$/i
| table([@timestamp, ComputerName, UserName, DomainName, ContextBaseFileName, aid])
| sort(@timestamp, order=desc, limit=300)

// HUNT: DNS resolution of the campaign's Azure-hosted C2 FQDNs (exact hosts only)
// MITRE: T1102, T1090 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, DnsRequest
// LOOKBACK: 90d, set in the Falcon console time picker
// FALSE POSITIVES: none for these exact hostnames. The PARENT namespace is a different story, see Q8
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(smartconnect|neexportfolio|toadreport|business-deegital|businessdeegital|business-startup|businessstartup|healthcarezoom-centeral|healthcarezoomcenteral)\.azurewebsites\.net$/i
| table([@timestamp, ComputerName, UserName, DomainName, ContextBaseFileName, aid])
| sort(@timestamp, order=desc, limit=300)

// HUNT: azurewebsites.net lookups from processes that are not browsers, ranked by rarity
// MITRE: T1102, T1090 | CONF: medium  FP: high  COST: medium
// REQUIRES: Falcon Windows sensor, DnsRequest
// LOOKBACK: 14d, set in the Falcon console time picker
// FALSE POSITIVES: LOB apps, vendor updaters, telemetry SDKs and installers all use Azure App Service
// TUNING: exclude your own App Service hostnames by DomainName first, then exclude the
// TUNING: signed vendor updaters you can account for by ContextBaseFileName. Never exclude
// TUNING: rundll32.exe, regsvr32.exe or an unsigned binary. Triage lowest Hosts count first.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/\.azurewebsites\.net$/i
| ContextBaseFileName!=/^(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|msedgewebview2\.exe|brave\.exe|opera\.exe)$/i
| ContextBaseFileName!=/^(svchost\.exe|teams\.exe|outlook\.exe|onedrive\.exe|ms-teams\.exe)$/i
| groupBy([DomainName, ContextBaseFileName], function=[count(as=Lookups), count(ComputerName, distinct=true, as=Hosts)], limit=2000)
| sort(Hosts, order=asc, limit=200)

// HUNT: outbound connections to the published Nimbus Manticore C2 IP
// MITRE: T1071.001, T1090 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Windows sensor, NetworkConnectIP4
// LOOKBACK: 90d, set in the Falcon console time picker
// FALSE POSITIVES: possible if the address is shared hosting. Verify ownership before blocking
#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4=/^172\.86\.98\.113$/
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid])
| sort(@timestamp, order=desc, limit=200)

// HUNT: NetSetup.log read by a process outside the domain-join toolchain
// MITRE: T1005, T1082 | CONF: medium  FP: medium  COST: low
// REQUIRES: FileOpenInfo. Verify this event is collected in your tenant before trusting a null result
// LOOKBACK: 30d, set in the Falcon console time picker
// FALSE POSITIVES: inventory agents, RMM tooling and IT support scripts read this file legitimately
// TUNING: exclude your RMM and inventory agent by ContextBaseFileName after confirming the binary
// TUNING: is signed and on its expected path. Never exclude rundll32.exe or an unsigned writer.
#event_simpleName=/^FileOpenInfo$/
| TargetFileName=/windows\\debug\\netsetup\.log$/i
| ContextBaseFileName!=/^(svchost\.exe|netsetup\.exe|mmc\.exe|msiexec\.exe|explorer\.exe|notepad\.exe|trustedinstaller\.exe)$/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ContextBaseFileName, aid])
| sort(@timestamp, order=desc, limit=200)

// HUNT: single process sourcing broad internal TCP fan-out (SOCKS5 relay behaviour)
// MITRE: T1090.001, T1046 | CONF: medium  FP: medium  COST: medium
// REQUIRES: Falcon Windows sensor, NetworkConnectIP4 with internal destinations retained
// LOOKBACK: 7d, set in the Falcon console time picker
// FALSE POSITIVES: vulnerability scanners, monitoring and backup agents, SCCM, admin jump boxes
// TUNING: exclude scanner and management hosts by ComputerName, and nessus/qualys/rapid7 agents
// TUNING: by ContextBaseFileName. Do NOT exclude by port range, the operator picks the ports.
// TUNING: Review workstation-class hosts first, they should never appear here at all.
#event_simpleName=/^NetworkConnectIP4$/
| cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
| groupBy([ComputerName, ContextBaseFileName, aid], function=[count(as=Conns), count(RemoteAddressIP4, distinct=true, as=Peers), count(RemotePort, distinct=true, as=Ports)], limit=5000)
| Peers > 15
| Ports > 4
| sort(Peers, order=asc, limit=200)

Three of the hunt hypotheses are clean enough to promote from Investigate-only searches to blocking Custom IOAs. The rest stay as scheduled hunts. Deploy every IOA to a pilot host group in Detect mode first, review a full week of hits, then move to Prevent.

Not suitable as an IOA

• Mutex names. A8215357-F99A-44FE-BC65-D8F0434B0C03 and F56E68DA-4A89-46B4-9AC8-7290A7651000 are excellent, uniquely identifying artefacts, but Custom IOAs cannot express a mutex condition and the standard Falcon event model carries no mutex event. Route them to a YARA memory-scan rule and to any secondary EDR or memory-forensics tooling instead.
• ArcBridge config block. The delimiters <<STARTXX>> and <<ENDXX>> wrapping the implant identifier 4B8CC395-A26F-41F1-A1DC-8B993D9D41D2 make a strong static YARA signature. That belongs in file and memory scanning, not in an IOA.
• Q8 (Azure namespace). Far too noisy for a blocking rule. Leave it as a scheduled hunt whose output is correlated against Q1 through Q4.
• Q11 (relay fan-out). The signal depends on host role, which an IOA cannot reason about. Keep it as a weekly scheduled search reviewed by a human.

Scheduled search and alerting package

Triage checklist (L1, in order)

1. Confirm the hit is not from a known packaging or sequencing host. If it is, close as expected and add the host group to the IOA exclusion.
2. Network-contain the host in Falcon. Do not power it off, and do not reimage. Memory is the only place the mutex and the decoded config exist.
3. Pull the full directory listing of the path where AppVShNotify.exe ran. Look for a co-located SspiCli.dll. Hash it and compare against the s10 MD5 list.
4. Run Q5 fleet-wide against the collected hash. Per-target compilation means a new hash is likely, so also run Q3 and Q4 fleet-wide for the filenames and paths.
5. Run Q6, Q7 and Q9 scoped to the affected host, then fleet-wide. Any C2 domain hit confirms the infection and gives you the campaign phase.
6. Check the host's outbound proxy log for the three NightLedger URI paths and for a GET /connect WebSocket upgrade (s7.1, s7.2).
7. Run Q11 scoped to the affected host over 30 days. If it shows internal fan-out, the relay was operational and the blast radius is every internal system it touched, not just this host.
8. Assume credential compromise for the logged-on user. Reset the password and revoke sessions and Kerberos tickets. The implant replays that user's SSO context to the proxy by design.

Pivot queries

• Host-scoped: add | ComputerName=/^HOST-01$/i to Q6, Q9 and Q11 to build the single-host timeline.
• Sibling-host: take every internal peer address from Q11 output and run Q1 through Q4 against those hosts. The relay's targets are the actor's next foothold.
• Same-writer: take the ContextBaseFileName from a Q2 or Q3 hit and search fleet-wide for every other file that process has written. That is the dropper's full inventory.

Every atomic indicator below is published by Kaspersky GReAT (2026-07-28) and traces verbatim to the saved source snapshot. Import the CSV into Falcon IOC Management, then deploy the behavioural signatures, which are what will still be working after the actor's infrastructure rotates.

type,value,action,severity,expiration,description,tags
md5,A239E655709A2518DD0B7BDBED163679,prevent,critical,2027-01-29,NightLedger backdoor sspicli.dll,campaign:NimbusManticore
md5,5FA15EF96808EA82F0A6176F0BB4B386,prevent,critical,2027-01-29,ArcBridge WebSocket tunneler,campaign:NimbusManticore
md5,42F847597109DA2A220391BB09D00676,prevent,critical,2027-01-29,ArcBridge WebSocket tunneler,campaign:NimbusManticore
md5,AFB1C1583606599C7272CFB33CC6F498,prevent,critical,2027-01-29,ArcBridge WebSocket tunneler,campaign:NimbusManticore
md5,6038D42AF0AFFD1FB263F470C0956F6B,prevent,critical,2027-01-29,BridgeHead tunneler unbcl.dll,campaign:NimbusManticore
md5,AE628EFA305387B633DCE82F9364875B,prevent,critical,2027-01-29,BridgeHead tunneler unbcl.dll,campaign:NimbusManticore
md5,F7D36CC5904A53252D2BB3D21615134F,prevent,critical,2027-01-29,BridgeHead tunneler libwinpthread-1.dll,campaign:NimbusManticore
md5,C90F0EFADBF322E5EB1C4103A38C30E6,prevent,critical,2027-01-29,BridgeHead tunneler libwinpthread-1.dll,campaign:NimbusManticore
md5,D09B14A2FE01C7363ECC56F5D046162C,prevent,critical,2027-01-29,BridgeHead tunneler IPHLPAPI.dll,campaign:NimbusManticore
md5,C832ECD135781B11F59E3FFFB3D2B6AC,prevent,critical,2027-01-29,BridgeHead variant WSS 443 non-Azure C2,campaign:NimbusManticore
domain,realhealthshop.com,detect,high,2026-10-29,NightLedger primary C2,campaign:NimbusManticore
domain,tjconsultingservices.com,detect,high,2026-10-29,NightLedger fallback C2,campaign:NimbusManticore
domain,aecert.org,detect,high,2026-10-29,ArcBridge C2 port 443,campaign:NimbusManticore
domain,smartconnect.azurewebsites.net,detect,high,2026-10-29,BridgeHead C2 WebSocket upgrade,campaign:NimbusManticore
domain,businessmixture.com,detect,high,2026-10-29,BridgeHead variant C2 over WSS,campaign:NimbusManticore
domain,global-reds.com,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,maadinglobal.com,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,business-deegital.com,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,business-deegital.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,businessdeegital.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,neexportfolio.com,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,neexportfolio.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,neexportfolio.eastus.cloudapp.azure.com,detect,high,2026-10-29,Azure cloudapp C2 host,campaign:NimbusManticore
domain,toadreport.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,healthcarezoom-centeral.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,healthcarezoomcenteral.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,healthcarezoomcenteral.org,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,thehealth-life.com,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,buisness-centeral-transportation.com,detect,high,2026-10-29,Campaign infrastructure,campaign:NimbusManticore
domain,business-startup.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
domain,businessstartup.azurewebsites.net,detect,high,2026-10-29,Azure App Service C2 host,campaign:NimbusManticore
ipv4,172.86.98.113,detect,high,2026-10-29,Campaign infrastructure verify not shared hosting before block,campaign:NimbusManticore

# These outlive the hashes and domains. Deploy them first.

SIDE-LOAD PAIR
  AppVShNotify.exe executing outside the Office / App-V install tree
  SspiCli.dll present in the same directory as AppVShNotify.exe
  SspiCli.dll anywhere other than System32 / SysWOW64 / WinSxS / servicing

TUNNELER STAGING PATHS
  Any PE written under %LocalAppData%\Microsoft\VisualStudio
  Any PE written under a VPN vendor path ending in \promote\
  DLL basenames: unbcl.dll, libwinpthread-1.dll, IPHLPAPI.dll outside system dirs

C2 SHAPE
  HTTP GET to a 20+ character keyboard-walk URI path with no query string
  WebSocket upgrade: GET /connect with Upgrade: websocket
  Hardcoded Chrome 86 / Edg 86 user agent on a WebSocket upgrade
  Three HTTP 407 retries with Negotiate then NTLM, then HTTP 101
  Binary WebSocket frame containing the literal string "token" as first message
  PING keepalive at a fixed 30 second interval over a TLS 443 WebSocket

RELAY BEHAVIOUR
  A workstation-class host sourcing internal TCP connections to many peers/ports
  Inbound-initiated tunnel setup: outbound flow stays open, internal fan-out follows
  Internal connection breadth that starts abruptly with no software-deployment cause

COLLECTION
  C:\Windows\debug\NetSetup.log read by a process outside the domain-join toolchain
  Screenshot capture by a process with no UI and no user interaction

# Not importable as Falcon IOCs. Route to YARA and memory forensics.

MUTEXES (single-instance guards)
  A8215357-F99A-44FE-BC65-D8F0434B0C03    NightLedger
  F56E68DA-4A89-46B4-9AC8-7290A7651000    ArcBridge

ARCBRIDGE EMBEDDED CONFIG
  Delimiters:  <<STARTXX>>  ...  <<ENDXX>>
  Implant id:  4B8CC395-A26F-41F1-A1DC-8B993D9D41D2
  Fields:      C2 host, C2 port, retry/timeout ms, SSL flag, implant id
  Commands:    OPEN:   creates a proxy/tunnel session
               DNS:    resolves a hostname and returns the result

NIGHTLEDGER C2 PROTOCOL
  Field delimiter:  (#%%#)
  Tasking GET:      /edfcvfgbhnjmkqwasderfgg
  Output POST:      /wsdefvvbnhyuijkplmbgfrtt
  Upload POST:      /qasxcdfvgbhnmyuioplkhnj

BRIDGEHEAD WIRE FORMAT (8 byte header, then payload)
  offset 0  size 1    type      message type 1-9
  offset 1  size 4    connId    tunnel connection identifier
  offset 5  size 1    flags     status or error indicator
  offset 6  size 2    dataLen   payload length
  Types: 1 CONNECT, 2 CONNECT_RESPONSE, 3 DATA, 4 DISCONNECT,
         5 PING, 6 PONG, 9 FLOWCTRL

RELATED TOOLING (same actor, prior reporting)
  NightLedger is functionally close to TWOSTROKE
  BridgeHead proxy logic mirrors Retrograde / MiniFast / MiniUpdate
  Earlier tunnelers: LIGHTRAIL, POLLBLEND

ALIASES
  Nimbus Manticore, Mirage Kitten, GalaxyGato, Smoke Sandstorm,
  Subtle Snail, TA455, UNC1549

# Run these before trusting any negative result from this pack.

TELEMETRY
  [ ] %LocalAppData% is NOT excluded from Falcon file-write monitoring
  [ ] Third-party VPN program directories are NOT excluded
  [ ] FileOpenInfo is being collected (else Q10 returns a false clean)
  [ ] NetworkConnectIP4 retains RFC1918 destinations (else Q11 is blind)
  [ ] Proxy logs retain URI path, Host header and User-Agent for 90 days

ENDPOINT CONTROLS
  [ ] SafeDllSearchMode = 1 in Session Manager
  [ ] CWDIllegalInDllSearch set to remove CWD from the DLL search order
  [ ] WDAC or AppLocker DLL rules block DLL load from user-writable paths
  [ ] ASR: block executable content from email client and webmail
  [ ] Mark-of-the-Web preserved through the archive tools in use
  [ ] Mounting of ISO/VHD/VHDX by standard users is blocked

NETWORK CONTROLS
  [ ] Outbound 443 requires the authenticated proxy, no direct egress
  [ ] WebSocket upgrades through the proxy are logged and reviewable
  [ ] Newly registered / low reputation domain categories are blocked
  [ ] Workstation-to-workstation internal traffic is restricted or logged

IDENTITY
  [ ] NTLM outbound restricted; Negotiate preferred and audited
  [ ] Extended Protection for Authentication enabled on the proxy
  [ ] Domain-join / support accounts cannot log on to workstations interactively

Work these four gates in order. A query that has not cleared gate 2 should not be scheduled, and a query that has not cleared gate 3 should never be promoted to Prevent.

Do not detonate live samples to validate. Each BridgeHead build gates on a hardcoded substring of the target's Windows username and exits silently on mismatch, so a live sample will do nothing in your lab and you will conclude, wrongly, that your detections do not work. Use the benign file and process placements in gate 3 instead: they exercise exactly the same telemetry paths.

Raw configuration for the highest-leverage controls. Every step carries its prerequisites, reboot requirement and rollback. Test each on a pilot ring before fleet deployment.

P1 · Harden the DLL search order (H-1)

Prerequisites: Local administrator or SYSTEM. Applies to Windows 10, Windows 11 and Windows Server 2016 and later. Pilot ring of at least 20 hosts covering your legacy line-of-business applications.
Reboot required: Yes. Both values are read at session-manager initialisation, so they take effect on the next boot.
Rollback: Set SafeDllSearchMode back to 0 and delete the CWDIllegalInDllSearch value, then reboot. If a legacy application breaks, roll back CWDIllegalInDllSearch first and keep SafeDllSearchMode, which is the safer half and rarely breaks anything.

$key = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager'

# Capture current state for rollback BEFORE changing anything
Get-ItemProperty $key -Name SafeDllSearchMode,CWDIllegalInDllSearch -ErrorAction SilentlyContinue |
    Export-Clixml -Path C:\Windows\Temp\dllsearch-rollback.xml

# Prefer system directories over the application directory in the DLL search order
New-ItemProperty -Path $key -Name 'SafeDllSearchMode' -Value 1 -PropertyType DWord -Force

# Remove the current working directory from the DLL search order entirely
New-ItemProperty -Path $key -Name 'CWDIllegalInDllSearch' -Value 0xFFFFFFFF -PropertyType DWord -Force

# Verify (values apply after the next reboot)
Get-ItemProperty $key -Name SafeDllSearchMode,CWDIllegalInDllSearch

# ROLLBACK
# Set-ItemProperty -Path $key -Name 'SafeDllSearchMode' -Value 0
# Remove-ItemProperty -Path $key -Name 'CWDIllegalInDllSearch' -ErrorAction SilentlyContinue
# Restart-Computer

P2 · Enable the delivery-path ASR rules (H-2, H-3)

Prerequisites: Microsoft Defender Antivirus in active mode with real-time protection on. Defender for Endpoint licensing is not required for ASR, but reporting is much better with it. Run in AuditMode for one full business cycle before enabling.
Reboot required: No. Rules apply immediately.
Rollback: Re-run the same command with -AttackSurfaceReductionRules_Actions Disabled for the specific rule GUID, or AuditMode to keep visibility without blocking. Rollback is immediate and needs no reboot.

# Step 1: audit first. Collect one business cycle, then review Event ID 1122 (audit) in
# Microsoft-Windows-Windows Defender/Operational before switching to Enabled.
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550, `
    01443614-cd74-433a-b99e-2ecdc07bfc25, `
    D3E037E1-3EB8-44C8-A917-57927947596D `
  -AttackSurfaceReductionRules_Actions AuditMode,AuditMode,AuditMode

# Step 2: after the audit window is clean, enable enforcement
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550, `
    01443614-cd74-433a-b99e-2ecdc07bfc25, `
    D3E037E1-3EB8-44C8-A917-57927947596D `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled

# Verify
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# ROLLBACK (per rule, immediate, no reboot)
# Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
#   -AttackSurfaceReductionRules_Actions Disabled

P3 · Restrict outbound NTLM and stop SSO relay to the proxy (H-5)

Prerequisites: Domain administrator for the GPO. A complete inventory of applications that rely on outbound NTLM, which the audit step below produces. Do not skip the audit phase: going straight to Deny will break line-of-business applications that authenticate to non-domain servers.
Reboot required: No, but a Group Policy refresh (gpupdate /force) and a new logon session are needed for the policy to take effect for a user.
Rollback: Set the policy back to Allow all (value 0) and run gpupdate /force. Effect is immediate for new authentication attempts. Keep the audit-phase exception list so a re-enablement does not have to rediscover it.

# PHASE 1 - AUDIT (deploy this first, collect for at least one full business cycle)
# GPO path: Computer Configuration > Policies > Windows Settings > Security Settings >
#           Local Policies > Security Options
#   "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" = Audit all
#   "Network security: Restrict NTLM: Audit Incoming NTLM Traffic"             = Enable auditing for all accounts
#
# Registry equivalent:
$lsa = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0'
New-ItemProperty -Path $lsa -Name 'RestrictSendingNTLMTraffic' -Value 1 -PropertyType DWord -Force  # 1 = Audit

# Review: Microsoft-Windows-NTLM/Operational, Event IDs 8001, 8002, 8003
# Build the exception list from those events using
#   "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication"

# PHASE 2 - ENFORCE (only after the exception list is complete and stable)
Set-ItemProperty -Path $lsa -Name 'RestrictSendingNTLMTraffic' -Value 2                             # 2 = Deny all

# Verify
Get-ItemProperty -Path $lsa -Name RestrictSendingNTLMTraffic
gpresult /h C:\Windows\Temp\gpo-report.html

# ROLLBACK (immediate for new authentications)
# Set-ItemProperty -Path $lsa -Name 'RestrictSendingNTLMTraffic' -Value 0   # 0 = Allow all
# gpupdate /force

P4 · Audit reads of NetSetup.log (H-6)

Prerequisites: Local administrator. Security event log sized to at least 1 GB, or forwarding to the SIEM already in place. Confirm your SIEM ingests Security Event ID 4663 before enabling, or the audit trail lands only in the local log.
Reboot required: No. Audit policy and SACL changes take effect immediately.
Rollback: Remove the audit rule from the file ACL and set the subcategory back to /success:disable. Immediate, no reboot. Rollback is worth doing if event volume is unexpectedly high, since object-access auditing applied too broadly can flood the Security log.

$file = 'C:\Windows\debug\NetSetup.log'

# 1. Enable the audit subcategory (object access is off by default)
auditpol /set /subcategory:"File System" /success:enable

# 2. Add a read SACL for Everyone on the target file only.
#    Scope is deliberately one file. A directory-wide SACL floods the Security log.
$acl  = Get-Acl -Path $file -Audit
$rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            'Everyone', 'ReadData', 'None', 'None', 'Success')
$acl.AddAuditRule($rule)
Set-Acl -Path $file -AclObject $acl

# 3. Verify the SACL is present
(Get-Acl -Path $file -Audit).Audit

# 4. Hunt: Security Event ID 4663 where ObjectName is the file above.
#    Exclude the process images your domain-join and support tooling legitimately use.
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4663 } -MaxEvents 200 |
    Where-Object { $_.Message -match 'NetSetup\.log' } |
    Select-Object TimeCreated, Message

# ROLLBACK (immediate)
# $acl = Get-Acl -Path $file -Audit
# $acl.RemoveAuditRuleAll($rule)
# Set-Acl -Path $file -AclObject $acl
# auditpol /set /subcategory:"File System" /success:disable

P5 · Block direct workstation egress on 443 (H-4)

Prerequisites: The authenticated explicit proxy must already be deployed, reachable and configured via PAC or WPAD on every workstation. Confirm proxy reachability from the pilot ring before applying, or you will take those hosts offline.
Reboot required: No. Firewall rules apply immediately.
Rollback: Disable or delete the rule. Immediate. Because the failure mode here is total loss of internet access for the affected hosts, deploy to a single small ring first and keep an out-of-band management path to those hosts.

# Host-level backstop. The authoritative control belongs on the perimeter firewall;
# this rule catches hosts that bypass the proxy or roam off-network.

$proxy = '10.10.10.10'   # REPLACE with your proxy address or subnet

# Allow the proxy explicitly, first
New-NetFirewallRule -DisplayName 'Allow 443 to corporate proxy' `
  -Direction Outbound -Action Allow -Protocol TCP -RemotePort 443 `
  -RemoteAddress $proxy -Profile Domain,Private,Public

# Then deny everything else on 443
New-NetFirewallRule -DisplayName 'Block direct outbound 443 (proxy bypass)' `
  -Direction Outbound -Action Block -Protocol TCP -RemotePort 443 `
  -Profile Domain,Private,Public

# Verify
Get-NetFirewallRule -DisplayName 'Block direct outbound 443 (proxy bypass)' |
    Get-NetFirewallPortFilter

# ROLLBACK (immediate)
# Remove-NetFirewallRule -DisplayName 'Block direct outbound 443 (proxy bypass)'
# Remove-NetFirewallRule -DisplayName 'Allow 443 to corporate proxy'

Before anything else: do not reimage, and do not power the host off. The mutex, the decoded ArcBridge config and the tunnel state exist only in memory. A relay host is also the single best source of evidence for where the operator went next, and reimaging destroys that. Network-contain it in Falcon and leave it running.

Reading the gaps

Six of the eighteen rows are gaps, and they cluster in two places. The first cluster is network payload visibility: the URI paths, the WebSocket upgrade, the proxy authentication and the exfiltration are all inside TLS, so endpoint EDR structurally cannot see them. Those four gaps close together the moment proxy URI logging exists (s7.1 through s7.3) and close fully with TLS inspection (H-9). The second cluster is in-memory artefacts: mutexes, the sandbox gate and screenshot capture have no corresponding sensor event, and no amount of query engineering creates one. Those are YARA and memory-forensics problems, and this pack routes them there in s9 rather than pretending a CQL query covers them.

What is not a gap is the loading chain. Q1 through Q4 cover the side-load and both staging paths with high confidence and low noise, and they fire before the relay becomes useful. That is the coverage that matters most, and it is the reason the executive summary sends analysts there first.

All eleven queries passed the review-v2 quality pass. Field names were validated against the Falcon data model; the only tenant-dependent element is FileOpenInfo in Q10, which is flagged in-query. No query carries an in-query time filter, so none can fail to parse on line 1. Every query rated FP medium or higher carries a // TUNING: exclusion inside the query block, so the guidance travels with the query when an analyst copies it into Falcon. Validation gates are in s11; run gate 1 before you trust any negative result from this pack.

Source snapshots. The fetched plain text of all three intelligence sources is preserved alongside this file in NimbusManticore-NightLedger-Hunt-sources/. Every atomic indicator in s4 and s10 is traceable verbatim to those snapshots. All three pages were checked for text directed at an automated agent; none was found, and no source was dropped.