Iran-linked hackers expand infrastructure across Europe and Middle East, report says
Group-IB found Iran-linked Tortoiseshell expanding command-and-control infrastructure into the UK, Belgium, Saudi Arabia and the UAE with new malware tooling.
Group-IB researchers identified new Tortoiseshell command-and-control infrastructure, including servers named 'uk1' and 'uk2' hosted on UK IP addresses, plus systems in Belgium, Saudi Arabia and the UAE. The Iran-linked espionage group, active since at least 2018 and previously tied to the Islamic Revolutionary Guard Corps, has historically targeted defense, aerospace, technology and military organizations in the Middle East and the United States. Researchers also uncovered new malware samples, including a backdoor resembling TwoStroke that enables command execution, file theft and system reconnaissance, and a tool establishing reverse SSH tunnels to attacker-controlled servers. Group-IB assesses that the group is expanding both its geographic reach and its capabilities and ranks it among the most active Iranian APTs of 2026.
- New Tortoiseshell servers found in the UK, Belgium, Saudi Arabia and the UAE
- New TwoStroke-like backdoor samples show continued use of the malware
- Reverse SSH tunnel tool enables covert access and network pivoting
- Group-IB calls Tortoiseshell one of the most active Iranian APTs in 2026
- Group previously linked to Iran's IRGC and espionage against defense targets
- Vendors
- Group-IB
- Products
- TwoStroke
- Threat actors
- Tortoiseshell
- Malware
- TwoStroke backdoor
- Organizations
- Islamic Revolutionary Guard Corps
From the original article
2 min read at therecord.media
Researchers have uncovered new infrastructure linked to an Iranian-linked threat actor that suggests it may be expanding its operations into Britain and other parts of Europe. The group, known as Tortoiseshell , has been active since at least 2018 and has primarily conducted espionage operations targeting defense, aerospace, technology and military organizations, particularly in the Middle East and the United States.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.