Iran-linked hackers expand infrastructure across Europe and Middle East, report says
Group-IB found Iran-linked Tortoiseshell expanding command-and-control infrastructure into the UK, Belgium, Saudi Arabia and the UAE with new malware tooling.
55
Threat actor
Tortoiseshell
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 26, 2026
- Last mentionedAug 26, 2026
Timeline
3 articles · newest firstNimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
60
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel
Group-IB uncovered new infrastructure linked to the Tortoiseshell threat actor, including an additional backdoor and an SSH tunneling tool.
45
Appears with
- Group-IBvendor · 3
- TwoStrokeproduct · 2
- Islamic Revolutionary Guard Corpsorganization · 1
- Nimbus Manticorethreat actor · 1
- BridgeHeadproduct · 1
- UNC1549threat actor · 1
- TwoStroke backdoormalware · 1
- NightLedgerproduct · 1
- Kasperskyvendor · 1
- SSH tunneling toolproduct · 1
- ArcBridgeproduct · 1
- NightLedgermalware · 1
- Charming Kittenthreat actor · 1
- IRGCorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.