"The discovered Tortoiseshell infrastructure potentially suggests an expanded targeting profile, focusing on Middle Eastern countries, alongside European countries," Group-IB researchers Mansour Alhmoud and Mohamed Emam said.
Group-IB's analysis of Nimbus Manticore and its links to Tortoiseshell
Singapore-based Group-IB published a new analysis today identifying additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state‑sponsored cyber espionage actor linked to the Islamic Revolutionary Guard Corps (IRGC). The company described Nimbus Manticore as among the most active Iranian APT groups in 2026. Group-IB lists multiple aliases for the actor — including GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549 — and assesses the cluster as linked to Tortoiseshell (also known as Imperial Kitten and Unyielding Wasp), which itself is part of the Charming Kitten (aka Eclipsed Wasp) cluster.
Group-IB noted Tortoiseshell activity dating back to at least July 2018 and said it has primarily targeted defense, aerospace, IT service providers, and military organizations in the Middle East and the United States. The report also called out the group's continued use of social engineering — including versions of the "Dream Job" campaign — to deliver malware under the pretext of job opportunities.
New infrastructure spanning Europe and the Middle East
Group-IB said its investigation uncovered extensive Tortoiseshell infrastructure across Europe and the Middle East. That discovery, the researchers wrote, potentially indicates an expanded targeting profile that includes both European and Middle Eastern countries. The newly identified components extend earlier reporting and show the group operating a broader range of access and persistence mechanisms than previously documented.
The findings build on a recent Kaspersky report that detailed additional tools used by the actor: a Windows backdoor called NightLedger and two custom WebSocket tunnelers named BridgeHead and ArcBridge, which Kaspersky linked to efforts to maintain persistent access to compromised hosts across the Middle East, Africa, and South Asia.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadReverse SSH tunneler masquerading as the Windows Terminal Server SDK
One of the artifacts Group-IB disclosed is a reverse SSH tunneling utility that poses as the Windows Terminal Server SDK API. The tool establishes an SSH connection to operator infrastructure identified at "172.86.98[.]113" on port 443. By masquerading as a legitimate API component, the utility can create an outbound SSH channel allowing remote operators to reach internal hosts via the established tunnel.
Group-IB's description underscores how the actor combines protocol-level disguise and network pivoting: the use of port 443 and an SSH reverse tunnel gives the implant the ability to blend into common outbound traffic while providing a bidirectional conduit to operator infrastructure.
TWOSTROKE-like C++ backdoor that mimics wtsapi32.dll
The second newly documented family is a C++ backdoor that overlaps with a previously observed implant known as TWOSTROKE. Group-IB said this backdoor collects system information, loads DLLs, manipulates files, and implements persistence. To conceal its presence, the malware mimics the Windows Terminal Server SDK DLL ("wtsapi32.dll").
The backdoor contains three hard-coded command‑and‑control (C2) servers and attempts to establish an HTTPS connection to one of them, then awaits instructions. When a response is received, the implant extracts a command and spawns a worker thread to execute it. Supported capabilities include downloading and uploading files, executing binaries or DLLs, gathering host information, listing directories, and deleting specified files.
What this means for defense, aerospace, and IT service providers; and for regional incident responders
- Defense, aerospace, and IT service providers: These sectors are named in Group-IB's historical profiling of Tortoiseshell and therefore should be alert to the combination of social‑engineering lures (for example, Dream Job campaigns) and implants that provide persistent, stealthy access — specifically reverse SSH tunnels and a TWOSTROKE-like backdoor that mimics a system DLL.
- Regional incident responders in Europe and the Middle East: Group‑IB's identification of new infrastructure across Europe and the Middle East suggests responders in those regions should prioritize hunting for outbound SSH over port 443 to unfamiliar hosts such as "172.86.98[.]113" and fingerprints of a wtsapi32.dll imposter that establishes HTTPS to hard‑coded C2 servers.
- Enterprise security operations teams: The overlap with previously reported tools (NightLedger, BridgeHead, ArcBridge) and the presence of multiple tunneling and backdoor variants indicate defenders should correlate telemetry across SSH, HTTPS, DLL loads that mimic wtsapi32.dll, and suspicious file downloads tied to recruitment‑style social engineering.
Group-IB concludes that the actor's addition of an SSH-based tunneling tool and a TWOSTROKE-like backdoor — combined with infrastructure spanning new geographic areas — reflects a program that is refining its toolkit to maintain and expand access. "The identification of infrastructure targeting Middle Eastern and European countries alongside continued development of tools such as the TWOSTROKE backdoor and SSH-based tunneling utilities demonstrates a threat actor that is steadily evolving its toolset and adapting its techniques to maintain access across a growing number of targets," Group-IB said.
Read the original Group-IB summary at: https://thehackernews.com/2026/08/nimbus-manticore-expands-toolset-with.html
