Nimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.
- New reverse SSH tunneling tool connects to operator infrastructure at 172.86.98.113 on port 443.
- C++ backdoor masquerading as wtsapi32.dll overlaps with TWOSTROKE and supports file operations and persistence.
- Infrastructure suggests expanded targeting across Middle Eastern and European countries.
- Findings build on Kaspersky's NightLedger, BridgeHead, and ArcBridge disclosures.
- Nimbus Manticore assessed as one of the most active Iranian APT groups in 2026.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1572 Protocol TunnelingT1071.001 Web ProtocolsT1105 Ingress Tool TransferT1036 Masquerading
- Threat actors
- Nimbus ManticoreTortoiseshellCharming KittenUNC1549
- Malware
- NightLedger
- Organizations
- IRGC
- Countries
- IranUnited States
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore , an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC). Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.