On May 22, 2026, Check Point Research published an analysis of a campaign that should give every small business owner pause. An Iranian state-aligned hacking group called Nimbus Manticore — affiliated with the IRGC — has spent the last three months pushing a brand-new piece of malware called MiniFast onto computers across the United States, Europe, and the Middle East. Aviation companies, software firms, and telecom providers were the named targets, but the delivery method they used is the part every business needs to understand. Because this time, the attackers did not need to send a phishing email to anyone. They just waited for people to use Google.
A fake download page that ranked at the top of search
The campaign that researchers are calling out as the most worrying shift is the April 2026 wave. The attackers built a fake website impersonating the download page for SQL Developer — a free database tool from Oracle that thousands of IT staff, developers, and database administrators install every day. They registered dozens of supporting domains, linked them all back to the fake page to boost its search ranking, and stuffed the page with the exact phrases someone would type into a search bar: “Download SQL Developer,” “SQL Developer Free.” It worked. At the time Check Point analyzed it, the malicious site — getsqldeveloper dot com — was ranking near the top of both Bing and DuckDuckGo for the query “sql developer.”
Anyone who clicked the result, landed on the page, and downloaded the installer was now infected. There was no phishing email. There was no suspicious attachment. There was no fake job offer in a LinkedIn message. The victim went looking for software, the search engine handed them a poisoned result, and the malware did the rest. Researchers call this technique SEO poisoning, and Nimbus Manticore has now made it a primary delivery channel.
What MiniFast actually does once it is on the machine
MiniFast is not ransomware. It is not a screen-locker. It is something more dangerous for a small business: a quiet, persistent remote-control backdoor. Once the trojanized installer runs, the malware hides itself by hijacking a real scheduled task that Zoom or similar applications would normally create. It blends into legitimate system activity. It checks that it is being launched the way the attacker expects, so security tools that try to detonate it in a sandbox see nothing happen. And it disguises its network traffic as ordinary Chrome browser activity, communicating with its command server using JSON requests that look, on the wire, like a user browsing the web.
The operator on the other end of that connection can list directories, run shell commands, kill processes, upload and download files, create new scheduled tasks for persistence, and request elevation to administrator privileges. In other words: full remote control of the infected computer, persistent across reboots, blending into the network noise of a typical Windows workstation. For a small business, that is the entire endgame. Once attackers are inside one machine, they are inside the network — and from there they can reach the email server, the file shares, the QuickBooks data, and the saved browser passwords.
Why this matters to a business that has nothing to do with aviation or defense
It would be easy to read the Check Point report, see the words “IRGC” and “aviation sector,” and conclude that this is somebody else’s problem. That is the wrong conclusion. Two things matter for every small business owner reading this.
The first is that SEO poisoning, as a technique, is now in active use by a well-funded threat actor that has demonstrated it can rank malicious pages on major search engines. State-sponsored groups do not invent techniques and then keep them to themselves. They get copied. Within months, criminal ransomware crews will be running the same playbook — registering hundreds of domains, building fake download pages for popular small-business software like QuickBooks, Adobe Reader, Zoom, AnyDesk, or any of a dozen accounting and remote-access tools your team installs every week. The aviation industry was the lure for the state actor. Small businesses will be the lure for the imitators.
The second is that the most common employee security training — “do not click suspicious email attachments” — does not stop this attack. There is no email. There is no attachment. There is a search result, on what looks like the first page of Google or Bing or DuckDuckGo, and an employee who needs to install a tool to do their job. The training your team had in 2023 was not built for this.
The AI angle, and what it tells us about what is coming
Check Point’s researchers found multiple indicators that MiniFast itself was built with the help of AI coding assistants. Verbose function names, excessive error-handling around trivial operations, repetitive defensive logic patterns — the kind of fingerprints that large language models leave on generated code. This matters because it explains how Nimbus Manticore was able to ship an entirely new malware family during an active military conflict, while simultaneously running three different campaigns and standing up a fake-website SEO operation. AI did not write the strategy. But it almost certainly accelerated the engineering work that would otherwise have taken weeks.
The takeaway is not that AI is dangerous. The takeaway is that the speed at which attackers can produce new, novel, signature-free malware has just gone up. Antivirus tools that rely on recognizing known-bad files are going to miss more of this than they used to. Defense in 2026 has to assume the malware on the wire has never been seen before.
What a small business should actually do about this, this week
None of what follows requires an enterprise security budget. It requires a clear policy, a real conversation with your team, and — in most cases — a partner who can put the technical pieces in place so the policy is enforceable.
Stop downloading software from search results. The single biggest behavioral change that defeats this entire campaign is to never install software based on a search result. Go directly to the vendor’s known website. For Oracle SQL Developer, that means typing oracle.com into the address bar — not searching for “SQL Developer download.” For Zoom, that means zoom.us. For QuickBooks, intuit.com. If an employee is not sure of the official URL, that is a conversation with IT, not a guess based on what Google ranked first today.
Lock down who can install software in the first place. On a properly configured Windows network, day-to-day user accounts cannot install applications without an administrator approving it. This is not 1998. There is no reason a receptionist, a bookkeeper, or a sales rep needs the ability to install arbitrary executables on a company laptop. If your environment lets every user install anything they download, that is a configuration problem with a known fix.
Train your team on this specific scenario. Generic “be careful online” training has not aged well. Your employees need a 20-minute conversation that walks through what SEO poisoning is, what a trojanized installer looks like, and what to do when they need a piece of software they have not used before. We build that conversation around your actual environment — the tools your team uses, the workflows that involve downloading anything, the moments when someone is most likely to be in a hurry and skip the verification step. That is what real security awareness training looks like in 2026, and it is the single highest-return security investment a small business can make.
Have endpoint protection that does behavioral detection, not just signature matching. MiniFast is built to look like a Chrome process talking to a normal-looking domain. Traditional antivirus, comparing files against a list of known-bad hashes, is going to miss this until the hashes show up on a threat feed weeks from now. Modern endpoint protection watches for behavior — a “Chrome browser” that is actually a Zoom updater making JSON API calls to a server it has never contacted before, for example — and flags it on the first run. This is one of the layers we configure as part of every managed IT engagement, and it is the layer most small businesses are missing.
Make sure you have working backups, before you need them. If MiniFast or its inevitable criminal imitators reach your network, the difference between a bad week and a business-ending event is whether you can restore from clean, recent, off-site backups. Daily, encrypted, off-site, with the ability to roll back to a point before the compromise. Not USB drives in a desk drawer. Not last month’s copy on the same server that just got encrypted.
The bigger picture
The Nimbus Manticore campaign is a preview. State-sponsored Iranian intelligence operators used SEO poisoning and AI-assisted malware development during an active military conflict to compromise aviation, software, and telecom organizations. The techniques worked. They are now in the public literature. They will be copied — by criminal ransomware groups, by lower-tier nation-state actors, and by the broader cybercrime economy that watches what works and adopts it within months.
Small businesses do not get to opt out of this. The criminal imitators will not care that you are a dental practice in Smithfield or a property management firm in Raleigh. What they will care about is whether your team is trained, your endpoints are protected, your backups are real, and someone is watching the alerts. That is the work. It is not expensive when it is done proactively. It is catastrophic when it is not done at all.
If you are not sure where your business stands on any of the five items above, that is exactly the conversation we have on a discovery call. No pressure, no obligation, no sales pitch. Just a clear, honest assessment of what you already have working and where the gaps are.
Sources: Check Point Research, “Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict,” May 22, 2026. Additional reporting from The Hacker News, Infosecurity Magazine, GBHackers, and Industrial Cyber.
