Cybersecurity researchers say the Iranian state-sponsored actor Nimbus Manticore expands its toolkit with newly observed infrastructure and previously undocumented malware. The activity is described in a fresh analysis by Group-IB, which characterizes the group as one of the most active Iranian APT groups in 2026.
Nimbus Manticore is also known under multiple aliases, including GalaxyGato and Mirage Kitten. Researchers connect it to Tortoiseshell, which has been active since at least July 2018 and has focused on sectors such as defense, aerospace, IT services, and military organizations across the Middle East and the U.S.
What stands out in the latest findings is the addition of two capabilities: an SSH-based reverse tunneling utility and a C++ backdoor that overlaps with earlier TWOSTROKE-like behavior. Together, these components aim to support persistent access and remote command execution during intrusions.
Why Nimbus Manticore expands its toolkit now
According to Group-IB, the new discoveries build on prior reporting that described related tools used to maintain long-term foothold on compromised systems. Earlier work from Kaspersky detailed a Windows backdoor called NightLedger and custom WebSocket tunnelers intended to keep access stable across multiple regions.
The new report adds to that picture by documenting additional infrastructure and malware artifacts associated with the same threat actor ecosystem. Researchers note that the group’s tradecraft appears to be steadily evolving—both in the tools it deploys and in how it routes traffic for operator control.
Connection routing through reverse SSH tunneling
One of the newly identified artifacts is a reverse SSH tunneling tool. Rather than acting as a typical local forward proxy, it establishes an SSH connection back to the operator’s infrastructure. In the report, the destination is listed as an IP address identified as 172.86.98[.]113 on port 443.
A key detail is the tool’s attempt to blend into a legitimate Windows environment. The tunneling utility is reported to masquerade as the Windows Terminal Server SDK API, a tactic designed to make analysis and detection harder during incident response.
Reverse SSH tunneling also helps the attacker bypass some network restrictions. By having the compromised host initiate the connection, the operator can gain a controllable communication path even when inbound access is limited.
A new C++ backdoor with TWOSTROKE-like overlap
The second malware family described in the analysis is a C++ backdoor. Researchers state that it overlaps with a TWOSTROKE-like implant already attributed to the actor. This backdoor is reported to support multiple operational functions, including:
- Collecting system information
- Loading DLLs
- Manipulating files
- Maintaining persistence
To further hide its behavior, the malware mimics a Windows terminal server DLL—reported as wtsapi32.dll. It also uses one of three hard-coded command-and-control (C2) servers to establish an HTTPS connection and wait for instructions.
When the C2 server responds, the malware extracts the command and spawns a new worker thread to execute it. That design supports interactive operations with lower friction than a single-threaded command loop, and it can help the implant remain responsive during active sessions.
What the backdoor can do after it connects
Based on the observed capabilities, the backdoor’s command set focuses on common post-compromise tasks. Researchers describe commands that allow the malware to:
- Download and upload files
- Execute a binary or a DLL
- Gather host information
- List directories
- Delete specific files
This combination suggests a practical workflow. The tool can stage additional components, interact with the filesystem, and adjust its footprint by removing artifacts—actions consistent with campaigns that aim to remain in place and operate over time.
Broader targeting signals across Middle East and Europe
Group-IB highlights that the discovered Tortoiseshell infrastructure spans both Europe and the Middle East. Researchers interpret this as a potential expansion of targeting profile, with a focus that could include European organizations alongside Middle Eastern countries.
In the report, Group-IB analysts Mansour Alhmoud and Mohamed Emam state that the infrastructure potentially indicates expanded targeting beyond the previously known geography. They also point to the continued development of the TWOSTROKE-like backdoor and the addition of SSH-based tunneling utilities.
How previous campaigns fit the pattern
Nimbus Manticore has previously been linked to social engineering schemes. The analysis recalls the group’s history of running its own version of the “Dream Job” campaign, using job opportunity-themed lures to trick targets into engaging with malicious activity.
That earlier emphasis on pretext-based access complements the new technical capabilities. Once initial access is achieved—whether through phishing or other routes—tools like the SSH tunnel and C++ backdoor can help maintain control, manage follow-on actions, and adapt to changing operational needs.
Protective takeaways for defenders
For security teams, the most actionable lesson is to look for the combination of stealth and connectivity. The reverse SSH tunneling tool is described as masquerading as a Windows Terminal Server SDK API component and connects to a specific infrastructure target using an HTTPS-friendly port.
Meanwhile, the backdoor’s mimicry of wtsapi32.dll and its use of one of three hard-coded C2 servers via HTTPS should inform detection logic. Even without exact indicators, the behavioral pattern—remote command retrieval, multi-action execution, file operations, and persistence—can guide detection engineering.
Conclusion
In summary, Nimbus Manticore expands its toolset with a reverse SSH tunneling utility and a new C++ backdoor that shares characteristics with TWOSTROKE-like malware. The findings also point to evolving infrastructure and a targeting footprint spanning the Middle East and Europe. For defenders, the report underlines the importance of monitoring both network-adjacent behaviors (such as SSH-based reverse connectivity) and host-level traits (such as DLL mimicry and remote command execution).
Source: https://thehackernews.com/2026/08/nimbus-manticore-expands-toolset-with.html
