Tortoiseshell has been active since at least 2018, Group-IB reported in a technical write-up published on August 26.
Tortoiseshell, Mirage Kitten and the research trail
Group-IB began investigating the actor it tracks as Tortoiseshell after Kaspersky published research on the group in July. The same cyber-espionage cluster is tracked by Kaspersky under the name Mirage Kitten, and Group-IB said the group has primarily targeted defense, aerospace, IT service providers and military organizations in the Middle East and the United States.
Group-IB's August 26 report identified additional infrastructure and previously unreported malware samples that extend the group's operational toolkit and potentially broaden its geographic reach.
Reverse SSH tunneling utility masquerades as wtsapi32.dll
One newly identified sample is a reverse SSH tunneling utility disguised as the Windows Terminal Server API DLL, wtsapi32.dll. The sample forward-exported legitimate functions from the DLL while invoking Windows' OpenSSH client to connect to Tortoiseshell infrastructure.
By establishing a reverse tunnel, the malware can redirect traffic from a command-and-control (C2) server into the compromised network. Group-IB noted that this behavior aligned with techniques previously documented by the Google Threat Intelligence Group (GTIG) for UNC1549.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildC++ backdoor with HTTPS C2 and familiar capabilities
A second sample discovered by Group-IB is a C++ backdoor that the company said shows similarities to TWOSTROKE malware previously documented by GTIG in late 2025. Like the SSH utility, this backdoor was also disguised as wtsapi32.dll and appeared designed to be loaded via DLL search-order hijacking.
The backdoor establishes HTTPS communications with multiple hardcoded C2 servers and generates a unique identifier from the victim's fully qualified hostname. Its feature set includes execution of file and shell commands, in-memory DLL execution, file transfer, directory listing and file deletion — capabilities that support remote control and data-exfiltration workflows.
Infrastructure footprints extend to regional subdomains
Group-IB linked additional infrastructure to a previously known Tortoiseshell C2 domain. Two domains, locat[.]sbs and tiktok-u[.]sbs, resolved to related servers and contained subdomains using country or regional identifiers such as UAE, Saudi Arabia, the UK, Belgium, Canada, Australia and Japan.
While Group-IB stressed that the actual use of this infrastructure remained unclear because researchers had not identified related malware samples for every host, historical DNS data showed continuity: the tiktok-u[.]sbs subdomains had previously resolved to the same servers associated with locat[.]sbs, and the servers remained in use after tiktok-u[.]sbs was suspended by its registrar.
What this means for technologists, defense and policymakers
- Technologists and security teams: Group-IB recommended persistent threat hunting and specific monitoring for unusual wtsapi32.dll side-loading and outbound traffic associated with known Tortoiseshell infrastructure. Detection efforts should include scrutiny of DLL search-order behaviors and HTTPS connections to hardcoded C2 servers identified in the samples.
- Defense, aerospace, IT service providers and military organizations: Organizations in the sectors Group-IB identified as frequent targets should prioritize hunting for indicators tied to both the reverse SSH tunneling utility and the C++ backdoor, and review logs for DNS resolutions involving locat[.]sbs and tiktok-u[.]sbs subdomains bearing regional identifiers.
- Policymakers and registrars: The persistence of servers after a domain suspension — as observed with tiktok-u[.]sbs — highlights a need for coordination when infrastructure associated with malicious activity migrates or remains active under related hostnames.
Group-IB's findings extend the technical portrait of Tortoiseshell by documenting two distinct tools — a reverse SSH tunneling utility and a TWOSTROKE-like C++ backdoor — both leveraging wtsapi32.dll masquerading and DLL search-order behaviors. The discovery of regionalized subdomains tied to locat[.]sbs and tiktok-u[.]sbs raises the possibility of wider geographic interest across the Middle East and Europe, even as researchers caution that the precise operational use of those hosts has not been fully linked to malware samples.
For teams defending likely targets, the immediate next steps are concrete: hunt for anomalous wtsapi32.dll loads, trace outbound OpenSSH and HTTPS sessions to known C2 hosts, and map DNS histories for the named domains. The report leaves one clear practical question hanging for investigators and network defenders alike: how broadly have the newly identified servers been leveraged in active intrusions versus held in reserve as staging infrastructure?
https://www.infosecurity-magazine.com/news/tortoiseshell-new-backdoor-ssh/
