Iranian state-backed Nimbus Manticore deploys NightLedger and two WebSocket tunnelers to maintain covert access across three regions.