Nimbus Manticore adds a C++ backdoor and an SSH tunneler to its arsenal

August 26 analysis broadens the picture of an already highly active Iranian threat actor

On August 26, 2026, Group-IB published a new technical analysis on Nimbus Manticore, an Iranian state-sponsored group affiliated with the IRGC. The actor is described as one of the most active Iranian APTs of the year. The analysis is authored by researchers Mansour Alhmoud and Mohamed Emam. The report introduces two new tools: a reverse SSH tunneling tool and a C++ backdoor that shares similarities with TWOSTROKE. It also reveals an expanded Tortoiseshell infrastructure in Europe and the Middle East, signaling a possible broadening of targeting. Nimbus Manticore is also known by the aliases GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549. The discovery of new tools indicates that the group is investing in malware development.

A reverse SSH tunneler hidden in a fake Windows Terminal Server API

The first tool identified is a reverse SSH tunneling tool. It masquerades as an API of the Windows Terminal Server SDK, a legitimate-looking Microsoft component. Once activated, the tool establishes an SSH connection to the operator's infrastructure at 172.86.98[.]113 on port 443. Reverse tunneling allows bypassing network restrictions: the compromised system connects outbound, reducing the need to open inbound ports. The report does not provide details on the distribution vector. It is not known how the tool is installed on compromised systems.

The new C++ backdoor masquerades as wtsapi32.dll and replicates TWOSTROKE

Group-IB also identified a C++ backdoor that overlaps with TWOSTROKE, malware previously attributed to Nimbus Manticore. The new backdoor masquerades as wtsapi32.dll, a Windows system library. To communicate with the command-and-control center, it uses one of three hardcoded C2 servers and establishes an HTTPS connection. It functions as a passive implant: after startup, the backdoor waits for instructions. When it receives a response from a C2 server, it extracts the command and creates a new worker thread to execute it. Supported commands allow downloading and uploading files, executing a binary or DLL, collecting host information, listing directories, and deleting specific files. The backdoor also includes functions for system information gathering, DLL loading, file manipulation, and persistence. The passive behavior is consistent with a backdoor designed for prolonged operations. The addresses of the three C2 servers were not disclosed. The choice to masquerade as Terminal Server components, both in the tunneler and in the backdoor, suggests an attempt to evade signature-based detection.

NightLedger, BridgeHead, and ArcBridge: Kaspersky’s contribution

Group-IB's findings also build on a recent Kaspersky report. The Russian company described the Windows backdoor NightLedger and two custom WebSocket tunnelers, named BridgeHead and ArcBridge. These tools are used to maintain persistent access in attacks targeting the Middle East, Africa, and South Asia. Integrating the two reports makes it possible to reconstruct a broader and evolving arsenal. Nimbus Manticore combines backdoors and multiple types of tunnels to ensure persistence on systems. Persistence is provided by both the backdoor and the tunnelers, which allow access to be re-established even after reboots or partial cleanup.

From European infrastructure to sector-specific targeting: who is in the crosshairs

Nimbus Manticore is linked to Tortoiseshell, also known as Imperial Kitten or Unyielding Wasp. Tortoiseshell belongs to the Charming Kitten cluster, alias Eclipsed Wasp. Tortoiseshell has been active since at least July 2018 and targets defense, aerospace, IT service providers, and military organizations in the Middle East and the United States. The actor has previously run its own version of the “Dream Job” campaign, based on social engineering around job opportunities to distribute malware. The expanded Tortoiseshell infrastructure in Europe and the Middle East suggests a broadening of targeting toward Middle Eastern and European countries. The main impact is cyber espionage: persistent access to compromised systems, data exfiltration, and collection of sensitive information. Affected sectors include defense, aerospace, IT, and military. Geographic areas involved range from the Middle East to Europe, from the United States to Africa and South Asia. The extension of infrastructure in Europe and the Middle East, combined with attacks already reported in Africa and South Asia, outlines a multiregional operation. The report does not assign a CVSS score or formal severity classification, consistent with the state-sponsored espionage nature. The actor is evolving tools and techniques to maintain access to a growing number of targets.

Indicators of compromise and no specific mitigation

The published material does not contain specific mitigation guidance. In the absence of official patches or procedures, monitoring indicators of compromise remains the only immediate countermeasure available to defenders. The disclosed indicators are the IP address 172.86.98[.]113 on port 443 and the use of wtsapi32.dll as a disguise. The backdoor uses three hardcoded HTTPS C2 servers, but their addresses were not specified. The lack of published C2 addresses limits organizations' ability to proactively block communications. Organizations should pay attention to suspicious processes associated with wtsapi32.dll and to connections to the indicated IP.