Iran's IRGC Hackers Shipped a New Backdoor Mid-War. Check Point Says an AI Helped Write It.

On February 28, 2026, the United States and Israel launched Operation Epic Fury against Iran. The kinetic war ran until May 5. The cyber war, according to a Check Point Research report published last week, never paused for it.

Nimbus Manticore is an Iranian state-sponsored hacking group that Google's Mandiant tracks as UNC1549 and Palo Alto Networks tracks as Screening Serpens. Check Point has watched the group for years. It reports to the Islamic Revolutionary Guard Corps. Its historic targets are defense contractors, telecom operators, and aviation firms in the Middle East and Europe.

What changed in 2026, according to the company's threat intelligence team, was the speed. Three distinct campaign waves rolled out between February and April, each with new tooling. The middle wave introduced a previously unseen backdoor that Check Point named MiniFast. The April wave introduced a new delivery method for it: SEO poisoning, with a fake Oracle SQL Developer download page pushed to the top of Bing and DuckDuckGo.

That speed, Check Point assesses, was not entirely human.

What Tells the Researchers an AI Helped Write the Code

The MiniFast backdoor itself is a 64-bit Windows DLL. It exposes a single function, CheckForUpdates, that serves as the malware's entry point. It talks to its command-and-control server over HTTP with JSON envelopes, disguises its traffic with a Chrome 146 user-agent string, and supports 17 commands ranging from file uploads to privilege escalation.

In isolation, none of that is novel. What is novel is what the source code looks like.

Check Point's analysts list four code-level characteristics they found embedded throughout MiniFast and its loaders:

• Excessive error handling and defensive programming. Wrapper functions and try/catch blocks even around trivial calls like GetUserName that almost never fail in practice.
• Verbose, descriptive function names. Repetitive identifiers that read like the output of a model instructed to "produce clear, self-documenting code."
• Detailed error-reporting strings. Debug-style status messages embedded throughout the codebase, useful for development feedback, useless to an attacker trying to stay quiet on a compromised host.
• Modular code organization. The implant is structurally elegant in a way that the malware's overall simplicity does not warrant.

Each of these patterns, on its own, is a habit a senior engineer might cultivate. Together, they form the same fingerprint that security teams have been documenting in legitimate codebases since GitHub Copilot landed in 2021: code that is more careful, more verbose, and more modular than a human writing under deadline pressure would bother to make it.

The Three Waves of the Operation

Check Point divides the operation into three distinct phases, each with a different lure, a different delivery vehicle, and a steady upward curve in operational sophistication.

How SEO Poisoning Replaced the Spear Phish

For years, Nimbus Manticore's signature move was the fake job offer. A defense engineer in Israel or the UAE would receive a recruiter email, click an OnlyOffice link, and end up unpacking a ZIP file with a legitimately signed Setup.exe next to a malicious DLL. The pattern has been documented since at least 2024 and tracked under the name "Iranian Dream Job," a deliberate echo of the North Korean Lazarus group's "Operation Dream Job."

In April 2026, the group tried something new.

A domain named getsqldeveloper[.]com appeared, hosting a copy of the Oracle SQL Developer download page. The site itself was unremarkable. What surrounded it was not. According to Check Point, the threat actor registered dozens of supporting domains that linked back to the page, pushing its reputation upward in search ranking algorithms. By the time Check Point pulled the site apart, it ranked at the top of Bing and DuckDuckGo for the query "sql developer."

A database developer searching for the tool would click the result, download the installer, and execute it. The installer dropped MiniFast.

The pivot is meaningful. A spear-phishing campaign requires the operator to choose a target, research them, and write a convincing pretext. SEO poisoning requires the operator to choose a tool the target population probably uses, then wait. The first is a sniper rifle. The second is a fishing net cast in well-stocked water.

What the AI Angle Actually Means for Defenders

Check Point's report is one of several published in recent months that document state-sponsored threat actors using AI assistants to build offensive tooling faster. Anthropic's own threat report in November 2025 described Chinese state-affiliated activity that used Claude to support 16 million automated attack interactions. Google's Threat Analysis Group has logged similar patterns across multiple adversaries. The Nimbus Manticore findings, corroborated by a parallel report from Palo Alto Networks Unit 42 on the same activity cluster, push the trend one step further: the AI is now visible in the malware itself.

That visibility matters for two practical reasons.

First, it changes the economic model of state-sponsored hacking. A team that previously needed weeks to develop a new backdoor can now ship one in days. The same Check Point team that documented Iranian operations during the war noted that the threat actor did not slow down during the conflict. It accelerated. The capacity to ship new tooling on a wartime tempo, while a country's physical infrastructure is being targeted, is exactly what AI-assisted development buys.

Second, it gives defenders a new family of detection signals. The verbose error handling and the descriptive function names that look like Copilot habits in a developer's IDE look the same in a malware sample. Static analysis that pattern-matches on code style, an approach security vendors have been resistant to for years because of false positives, suddenly has a reason to reconsider.

The Other Side

Not every researcher accepts the AI-assisted framing without caveats. The signals Check Point lists are characteristic of LLM-generated code, but they are also characteristic of code written by a careful engineer using a static analyzer like SonarQube or running a linter on save. Excessive error handling can be a corporate code-review requirement. Modular structure can be the consequence of a team standard. The case for AI assistance in Check Point's report rests on the combination of signals appearing together inside malware whose underlying logic is simple enough that none of the polish is operationally necessary.

There is also a question of attribution confidence. Nimbus Manticore is well documented, and the certificate reuse and infrastructure overlap Check Point lists make this campaign a clear fit. But the same coding patterns are now turning up in samples attributed to multiple state actors across multiple geographies. Calling AI-assisted development a Nimbus Manticore signature requires assuming the group did not borrow the style from publicly leaked tooling, or vice versa. Check Point's report is careful on this point: it assesses with reasonable confidence, not certainty, that the development pipeline involved AI tooling.

What Practitioners Should Do This Week

For data scientists and ML engineers who download developer tools regularly, the SEO poisoning angle is the most actionable part of this story. The MiniFast installer impersonated SQL Developer, but the same pattern works for any tool a target population is likely to search for: TensorFlow CUDA installers, Anaconda, JupyterLab, MLflow, PyTorch Lightning.

The action list from the Check Point report and the parallel Unit 42 guidance:

• Download dev tools only from vendor-controlled URLs. Bookmark them. Do not search for the installer when you can navigate directly.
• Verify digital signatures even on signed binaries. The MiniFast loaders carried valid SSL.com certificates issued to Gray Matter Software S.R.L. and Kirubel Kerie Negeya. A valid signature confirms the certificate was paid for. It does not confirm the publisher is who they appear to be.
• Treat scheduled tasks named ZoomUpdateTask... and WindowsSecurityUpdate as suspect unless you can confirm the source. MiniFast hijacks the former for persistence and installs the latter as its second-stage callback.
• Block the indicators of compromise Check Point published, including the 27 file hashes and 27 domains listed in the report's appendix.

For broader context on the security side of AI development, see the TrapDoor supply chain campaign that targeted CLAUDE.md files, the PyTorch Lightning compromise that closed in 42 minutes, and the LiteLLM backdoor that handed attackers 95 million monthly downloads.

The Bottom Line

The story most observers will pull from this report is that Iranian state hackers used AI to write malware faster. That is true, and it matters. The deeper story is that the line between AI in offense and AI in defense is being drawn right now, in code samples being reverse-engineered in Tel Aviv and Santa Clara, and the same Copilot habits that make a junior engineer more productive are turning into the fingerprints of state-sponsored intrusion.

Check Point's report runs to several thousand words of analysis. The core of it, the part defenders will be quoting for the rest of 2026, fits in one sentence from the group manager: "The conflict didn't slow them down. It actually accelerated them."

The next time a major incident-response timeline reads "first sample observed Wednesday, second variant Thursday, fully different family Friday," the working assumption will not be that the group hired more developers. It will be that the developers got a copilot.

Sources

• Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict (Check Point Research, May 22, 2026)
• Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning (The Hacker News, May 26, 2026)
• Iranian threat group targets US aviation sector with AI-assisted 'MiniFast' backdoor (SC Media, May 2026)
• Iran-Linked Hackers Target US Aviation with Phishing and SEO Poisoning (Infosecurity Magazine, May 2026)
• IRGC-linked Nimbus Manticore group attacks defense, aerospace, telecom sectors using Minifast malware toolkit (Industrial Cyber, May 2026)
• Tracking Iran APT Screening Serpens (Palo Alto Networks Unit 42, May 2026)
• Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research, 2025)