Iranian State-Linked Hackers Deploy NodeRabbit Malware Against Aviation and Fintech Firms

Kaspersky's security research team announced on Tuesday that a new malicious tool called NodeRabbit has been linked to Iranian cyber espionage groups. The malware was first uncovered on a computer system in Afghanistan and subsequent analysis revealed variants operating on devices in Egypt and Ethiopia, indicating a widening geographical footprint.

NodeRabbit is designed to infiltrate development environments, allowing attackers to capture source code, credential stores and configuration files. Its modular architecture lets operators deploy additional payloads tailored to specific targets, a technique commonly observed in nation‑state cyber campaigns. The tool also includes capabilities to evade detection by blending into legitimate network traffic.

The report highlights aviation and financial‑technology (fintech) developers as primary victims. Both sectors handle sensitive data—flight control systems, passenger information, payment processing and transaction records—making them attractive to actors seeking strategic or economic intelligence. Iranian groups have a documented history of probing these industries, leveraging stolen data to bolster domestic capabilities or to gain leverage in geopolitical negotiations.

Finding the same malware across three distinct regions suggests a coordinated effort rather than isolated incidents. Afghanistan, Egypt and Ethiopia each host emerging tech ecosystems and growing aviation and fintech sectors, which may present softer targets compared to more heavily defended environments in Western countries. The spread also underscores the challenges of defending globally distributed supply chains.

Security professionals and software vendors have been urged to audit their development pipelines, enforce strict code‑signing practices, and monitor for anomalous network behavior associated with NodeRabbit. Kaspersky recommends applying the latest threat‑intelligence feeds, conducting regular penetration tests, and ensuring that third‑party libraries are sourced from trusted repositories.

Analysts expect the malware to evolve as defenders adapt, potentially expanding to other high‑value industries. Continued collaboration between private security firms, governmental agencies and affected companies will be essential to disrupt the threat actors' infrastructure and limit the impact of future incursions.