Nimbus Manticore (Iranian IRGC-affiliated APT, aka Tortoiseshell/UNC1549/Smoke Sandstorm/Mirage Kitten) deploys a third 2026 toolset refresh — a TWOSTROKE-like backdoor abusing DLL search-order hijacking, paired with a reverse SSH tunneler — with confirmed expansion into the UK, France, Albania and Belarus
Group-IB documents new infrastructure and a new toolset for Nimbus Manticore — the Iranian, IRGC-affiliated actor this pipeline already tracks under registry key actor:screening-serpens-unc1549-smoke-sandstorm-nimbus-manticore-iran-apt (aliases: Screening Serpens, UNC1549, Smoke Sandstorm, Mirage Kitten; Group-IB itself uses "Tortoiseshell"). This is the third distinct toolset refresh the store has now tracked for this actor within roughly seven months: six new RAT variants (MiniUpdate/MiniJunk V2) via AppDomainManager hijacking February–April 2026, the NightLedger backdoor with BridgeHead/ArcBridge WebSocket tunnelers documented by Kaspersky in July 2026, and now — reported by Group-IB on 2026-08-26 — a new reverse SSH tunneling utility and a TWOSTROKE-family C++ backdoor.
The SSH tunneler establishes an SSH connection to operator infrastructure over port 443, blending with normal HTTPS-port egress filtering, to set up a reverse tunnel: "execution of this command establishes an SSH connection to the operator's infrastructure ... on port 443 to set up a reverse tunnel. As a result, traffic sent to [a local port] on the C2 server is redirected back through the tunnel directly into the compromised network" (Group-IB, 2026-08-26) — giving the operator interactive network access into the victim environment without an inbound listener on the victim side. The TWOSTROKE-like backdoor masquerades as the Windows Terminal Server SDK DLL (wtsapi32.dll), forward-exporting all legitimate SDK functions so that a legitimate executable loading it via DLL search-order hijacking continues to function normally while the backdoor executes alongside it: "masquerading as the Windows terminal server SDK DLL (wtsapi32.dll), this backdoor forward-exports all legitimate SDK functions. It appears to be designed for DLL search-order hijacking, tricking legitimate executables into loading the backdoor" (Group-IB, 2026-08-26). It encrypts stack strings, derives a unique per-victim identifier from the device hostname, and communicates with multiple hardcoded control servers over HTTPS.
Group-IB's infrastructure analysis, based on geographically-labeled subdomain naming conventions, indicates expanded targeting into European nations specifically named as the UK, France, Albania and Belarus, alongside continued Middle Eastern targeting: "the group's infrastructure and targeting profile span across countries in Europe and the Middle East. Specific targets include European nations such as the UK, France, Albania, and Belarus, alongside Middle Eastern regions including Israel, Turkey, and GCC member states" (Group-IB, 2026-08-26) — a materially widened European footprint for an actor this pipeline already tracks as espionage-focused on aerospace, aviation, defence and telecommunications.
Triage: monitor for HTTPS-port (443) outbound connections that establish long-lived reverse-tunnel-shaped traffic patterns — asymmetric, low-volume-but-persistent bidirectional flows distinct from normal web-browsing HTTPS — and audit environments for a wtsapi32.dll present outside its expected system path or with a hash that does not match the legitimate Windows SDK component; the actor's own choice of a legitimate SDK DLL name is itself the detection anchor, since a genuine wtsapi32.dll never appears outside System32.
Execution of this command establishes an SSH connection to the operator's infrastructure ... on port 443 to set up a reverse tunnel. As a result, traffic sent to [a local port] on the C2 server is redirected back through the tunnel directly into the compromised network.
Masquerading as the Windows terminal server SDK DLL (wtsapi32.dll), this backdoor forward-exports all legitimate SDK functions. It appears to be designed for DLL search-order hijacking, tricking legitimate executables into loading the backdoor.
The group's infrastructure and targeting profile span across countries in Europe and the Middle East. Specific targets include European nations such as the UK, France, Albania, and Belarus, alongside Middle Eastern regions including Israel, Turkey, and GCC member states.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Execution TA0002
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1090Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.