Nimbus Manticore Deploys New Backdoor and Reverse SSH Tunneler
Group-IB has identified additional infrastructure and two previously undocumented tools tied to Nimbus Manticore, an Iranian state-sponsored cyber-espionage group assessed as affiliated with the Islamic Revolutionary Guard Corps. The findings include a reverse SSH tunneling utility and a C++ backdoor with similarities to TWOSTROKE, an implant already attributed to the actor.
Group-IB described Nimbus Manticore as one of the most active Iranian APT groups in 2026. The actor is also tracked as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail and UNC1549, and is assessed to be linked to Tortoiseshell, a cluster associated with Charming Kitten.
Infrastructure points to wider geographic interest
The researchers uncovered extensive Tortoiseshell infrastructure across Europe and the Middle East. Group-IB said the infrastructure potentially indicates an expanded targeting profile that includes Middle Eastern countries alongside European countries.
Tortoiseshell has been active since at least July 2018 and has mainly targeted defense, aerospace, IT service providers and military organizations in the Middle East and the United States. Nimbus Manticore has also used its own version of the Dream Job campaign, delivering malware through job opportunity-themed social-engineering lures.
The newly reported activity follows Kaspersky's account of NightLedger, a Windows backdoor used by the group, and two custom WebSocket tunnelers named BridgeHead and ArcBridge. Those tools were used to maintain persistent access in attacks against entities in the Middle East, Africa and South Asia.
Tunneling and backdoor functions
One newly identified artifact is a reverse SSH tunneling tool that masquerades as the Windows Terminal Server SDK API. It establishes an SSH connection to operator infrastructure at 172.86.98[.]113 over port 443, a port commonly associated with encrypted web traffic.
The second artifact overlaps with TWOSTROKE. It is a C++ backdoor that mimics the Windows terminal server SDK DLL, wtsapi32.dll, and uses one of three hard-coded command-and-control servers to establish an HTTPS connection and await instructions.
After receiving a response from its command-and-control server, the malware extracts a command and creates a new worker thread to execute it. Its functions include downloading and uploading files, executing a binary or DLL, gathering host information, listing directories and deleting specified files. TWOSTROKE itself supports system information collection, DLL loading, file manipulation and persistence.
What defenders should take from the findings
The combination of impersonated Windows components, encrypted command-and-control traffic and SSH tunneling gives the actor several mechanisms for maintaining access to compromised hosts. Group-IB said the continued development of the TWOSTROKE backdoor and SSH-based utilities demonstrates a steadily evolving toolset adapted to sustain access across a growing set of targets.
For businesses operating in the affected regions or sectors, the practical implication is to review detections for DLL names that imitate legitimate Windows components, investigate unexpected outbound SSH connections over port 443, and correlate them with anomalous HTTPS communications and file or process execution activity.