Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC).
Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026. Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549) is assessed to be linked to Tortoiseshell (aka Imperial Kitten and Unyielding Wasp), which is part of the Charming Kitten (aka Eclipsed Wasp) cluster.
Tortoiseshell is known to be active since at least July 2018, mainly targeting defense, aerospace, IT service providers, and military organizations in the Middle East and the U.S. Nimbus Manticore also has a history of orchestrating its own version of the Dream Job campaign to deliver malware under the pretext of job opportunity-themed social engineering attacks.
The Singaporean cybersecurity company said it uncovered extensive Tortoiseshell infrastructure spanning Europe and the Middle East, as well as an SSH-based tunneling utility and a C++ backdoor that shares similarities with TWOSTROKE, another backdoor already attributed to the threat actor.
"The discovered Tortoiseshell infrastructure potentially suggests an expanded targeting profile, focusing on Middle Eastern countries, alongside European countries," Group-IB researchers Mansour Alhmoud and Mohamed Emam said.
The findings build upon a recent report from Kaspersky, which detailed the threat actor's use of a new Windows backdoor called NightLedger and two custom WebSocket tunnelers, BridgeHead and ArcBridge, with an aim to maintain persistent access to compromised hosts in attacks aimed at entities across the Middle East, Africa, and South Asia.
One of the newly discovered artifacts is a reverse SSH tunneling tool that masquerades as the Windows Terminal Server SDK API, while establishing an SSH connection to the operator's infrastructure located at "172.86.98[.]113" on port 443.
The second malware family is a backdoor that overlaps with TWOSTROKE, a C++ implant that allows for system information collection, DLL loading, file manipulation, and persistence. The backdoor mimics the Windows terminal server SDK DLL ("wtsapi32.dll") and uses one of three hard-coded command-and-control (C2) servers to establish an HTTPS connection and await further instructions.
Upon receiving a response from the C2 server, it extracts from it the command and creates a new worker thread to execute it. The commands enable the malware to download/upload files, execute a binary or DLL, gather host information, list directories, and delete specific files.
"The identification of infrastructure targeting Middle Eastern and European countries alongside continued development of tools such as the TWOSTROKE backdoor and SSH-based tunneling utilities demonstrates a threat actor that is steadily evolving its toolset and adapting its techniques to maintain access across a growing number of targets," Group-IB said.
Facts Only
* Cybersecurity researchers found additional infrastructure and malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the IRGC.
* Group-IB assessed Nimbus Manticore as among the most active Iranian APT groups in 2026.
* Nimbus Manticore is linked to Tortoiseshell (also known as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549).
* Tortoiseshell is linked to the Charming Kitten cluster.
* Tortoiseshell has been active since at least July 2018.
* Tortoiseshell primarily targets defense, aerospace, IT service providers, and military organizations in the Middle East and the U.S.
* Nimbus Manticore orchestrated its own version of the Dream Job campaign for malware delivery via social engineering.
* Group-IB uncovered Tortoiseshell infrastructure spanning Europe and the Middle East.
* Infrastructure includes an SSH-based tunneling utility and a C++ backdoor similar to TWOSTROKE.
* The discovered infrastructure suggests targeting Middle Eastern and European countries.
* A reverse SSH tunneling tool masquerades as the Windows Terminal Server SDK API, connecting to "172.86.98[.]113" on port 443.
* A C++ backdoor overlaps with TWOSTROKE; it mimics "wtsapi32.dll," collects system information, and communicates via hard-coded C2 servers.
Executive Summary
Full Take
The narrative establishes a pattern of persistent operational evolution by an actor linking specific malware families and infrastructure to a state sponsor across multiple geopolitical regions. The transition from known activity (Tortoiseshell since 2018) to the discovery of novel methods (SSH tunneling, custom C++ backdoors) and expanded geographical reach (Europe alongside the Middle East) points toward a strategic effort in maintaining access against evolving defensive postures. The focus on tool development—specifically creating and deploying reverse SSH tunnels and file manipulation backdoors like TWOSTROKE—indicates a pragmatic, adaptive operational doctrine rather than static campaign execution. This evolution implies that objectives are not merely about initial compromise but about establishing resilient, cross-jurisdictional persistence. The implication for human agency lies in the necessity for defenders to continuously anticipate and map these adaptive toolset shifts; inertia in defensive strategy can be exploited by actors who prioritize evolving technical capabilities over tactical novelty.
Patterns detected: ARC-0043 Motte-and-Bailey, ARC-0024 Ambiguity
Sentinel — Human
The text reads like a summary of findings compiled from expert sources regarding cyber threat infrastructure, showing high fidelity to source reporting patterns.