Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
Summary: Group-IB reported new infrastructure and previously undocumented malware tied to Nimbus Manticore, an Iranian state-sponsored group linked to the IRGC, including an SSH-based tunneling utility and a C++ backdoor that overlaps with TWOSTROKE. The tunneling tool masquerades as the Windows Terminal Server SDK API and connects to 172.86.98[.]113 on port 443, while the backdoor mimics wtsapi32.dll and uses one of three hard-coded C2 servers over HTTPS to download and upload files, execute binaries or DLLs, gather host information, list directories, and delete files.
What you should know: Group-IB describes Nimbus Manticore as among the most active Iranian APT groups in 2026, and the newly found Tortoiseshell infrastructure spans Europe and the Middle East, suggesting a wider targeting profile than defense, aerospace, IT service providers, and military organizations alone.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026