Iran

Gbhackers •Mayura Kathir • August 26, 2026

Iran-linked threat actor Tortoiseshell is expanding its espionage toolkit with reverse SSH tunneling utilities and a TWOSTROKE-like backdoor designed to give operators covert, durable access to compromised internal networks. The research began with public reporting from Kaspersky on Mirage Kitten’s newer malware ecosystem, which included the NightLedger backdoor and WebSocket tunneling tools ArcBridge and BridgeHead. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB Threat Intelligence identified these developments following a report by Kaspersky. The group, also known as Mirage Kitten, has been active since at least 2018, primarily targeting defense and aerospace sectors in the Middle East and the US. The new backdoor, similar to the previously documented TWOSTROKE malware, is disguised as the Windows Terminal Server API DLL. It supports various malicious functions, including file manipulation and command execution. The reverse SSH tunneling tool enables covert access to compromised networks by redirecting traffic from command-and-control servers. Group-IB's findings suggest a broader targeting scope across Europe and the Middle East. The group has been linked to operations supporting Iran's Islamic Revolutionary Guard Corps (IRGC). Current intelligence indicates ongoing activity and potential threats to various sectors. 6 sources 77

Extracted Entities

Iran

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (2)

Tools (2)