Iran

Cybersecuritynews •Tushar Subhra Dutta • August 26, 2026

Iran-linked hackers have expanded an espionage effort with a Windows backdoor and reverse SSH tunnelling utility. The activity is tied to Tortoiseshell, also tracked as Mirage Kitten, UNC1549 and Nimbus Manticore. The campaign gives operators more ways to retain access after breaking into a network. The tunnelling tool can route traffic from an attacker-controlled server […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB Threat Intelligence identified these developments following a report by Kaspersky. The group, also known as Mirage Kitten, has been active since at least 2018, primarily targeting defense and aerospace sectors in the Middle East and the US. The new backdoor, similar to the previously documented TWOSTROKE malware, is disguised as the Windows Terminal Server API DLL. It supports various malicious functions, including file manipulation and command execution. The reverse SSH tunneling tool enables covert access to compromised networks by redirecting traffic from command-and-control servers. Group-IB's findings suggest a broader targeting scope across Europe and the Middle East. The group has been linked to operations supporting Iran's Islamic Revolutionary Guard Corps (IRGC). Current intelligence indicates ongoing activity and potential threats to various sectors. 6 sources 77

Extracted Entities

Iran

The full story

Extracted Entities

APT Groups (4)

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)