Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group

Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure.

Group-IB Threat Intelligence began investigating Tortoiseshell activity following public reporting by Kaspersky ( Securelist ). Through enrichment of the reported indicators and our own hunting rules, we identified additional infrastructure, broader targeting, and previously unreported malware samples associated with the group.

Tortoiseshell is an Iranian-linked threat actor that has been active since at least 2018, primarily targeting defence, aerospace, IT service providers, and military organisations in the Middle East and the United States. The group is known for its use of supply chain compromises, watering hole attacks, fake recruitment websites, and custom backdoors, and has been linked to operations supporting Iran’s Islamic Revolutionary Guard Corps (IRGC).

Tortoiseshell was amongst the most active Iranian APT groups in 2026 according to Group-IB Threat intelligence.

Group-IB customers can access comprehensive and up-to-date intelligence on Tortoiseshell — including infrastructure, tooling, indicators, and activity tracking — via the Group-IB Threat Intelligence Portal .

The first sample discovery comes from investigating a known C2 IP (172[.]86[.]98[.]113) from the abovementioned Securelist report:

Analysis of this sample shows this as a Reverse SSH tunneling tool. It masquerades as the Windows Terminal Server SDK API, while forward-exporting all legitimate functions of wtsapi32.dll .

The identified tool executes the following command for establishing the tunnel:

Figure 1. Sample analysis showing the tool establishing a reverse SSH tunnel.

Execution of this command establishes an SSH connection to the operator’s infrastructure at 172.86.98[.]113 on port 443 to set up a reverse tunnel. As a result, traffic sent to localhost:1081 on the C2 server is redirected back through the tunnel directly into the compromised network. This tool’s behavior aligns with TTPs previously documented by Google Cloud regarding UNC1549, which utilizes reverse SSH tunnels to forward traffic from a C2 server down into a compromised network.

The second sample discovery comes from Group-IB APT Hunting activities. Analysis of the sample shows similarities to TWOSTROKE backdoor previously reported by GTIG in late 2025, this indicates continued use of this backdoor by the TA.

Masquerading as the Windows terminal server SDK DLL ( wtsapi32.dll ), this backdoor forward-exports all legitimate SDK functions. It appears to be designed for DLL -order hijacking, tricking legitimate executables into loading the backdoor.

The execution of the backdoor begins within the DLLMain function. It starts by dynamically resolving necessary APIs and saving resolved function addresses inside a global map object. Subsequently, when the backdoor requires the execution of a previously resolved API function, it queries this map using the API name to extract the resolved function address.

Although the backdoor does not employ advanced obfuscation techniques, it notably stores all sensitive strings — including API and DLL names — as encrypted stack strings that are subsequently decrypted at runtime.

Figure 2. Second sample analysis shows TWOSTROKE backdoor decrypting stack strings.

Once the necessary API functions are resolved, the malware creates a worker thread dedicated to managing communication with the C2 server. This thread starts with the dynamic resolution of WinHttp API functions, which are required to establish network connectivity between the backdoor and the C2 infrastructure. After these WinHttp functions are successfully resolved, the implant creates a unique victim identifier for the infected machine. It does this by calling GetComputerNameExW with the name type set to ComputerNameDnsFullyQualified , which returns the machine’s fully qualified hostname (Hostname.DomainName). This string is then XORed using the repeating key “ Pn “, hex-encoded, and finalized by reversing the trailing two-thirds of the resulting hex string.

The backdoor utilizes multiple Command and Control (C2) servers such that if one goes down the available C2 server will be used . This specific sample analyzed by Group-IB contains three hardcoded C2 servers:

Figure 3. Example of an identified Tortoiseshell C2 server node on Group-IB Graph.

Using the previously resolved WinHttp functions, it establishes an HTTPS connection with the chosen C2 server by sending the unique host identifier through a POST request. Upon receiving a 200 response status code, it queries the server for available C2 commands. Subsequently, it creates a new worker thread to dispatch and execute the retrieved commands.

Upon receiving a response from the C2 server, the backdoor deserializes the command to extract its data. A typical C2 command comprises fields separated by the “ @##@ ” delimiter. These fields contain the command identifier or index, which is used to locate the appropriate C2 handler function from those registered at the start of the dispatch function’s execution, as well as the command arguments that are interpreted uniquely by each handler function.

Supported C2 commands are:

The third discovery comes as a result of pivoting from the known C2 domain (aecert[.]org) from the Securelist report. Related DNS information reveals the IP address 185.253.116[.]81:

Figure 4. New IP address linked to a known Tortoiseshell C2 identified via Group-IB Graph.

Two interesting domains were found to be related to this IP address:

Figure 5. Identifying two additional related domains on Group-IB Graph.

Expanding more on these domains shows interesting subdomains:

Figure 6. Further subdomain mapping via Group-IB Graph shows potential target profile expansion.

Complete IP-to-Subdomain Mapping for domain locat[.]sbs:

This infrastructure discovery is particularly interesting because of the subdomains resembling country names. The actual use of this infrastructure is still not clear at the time of this report since no related samples were identified so far, and the infrastructure alone doesn’t reveal enough details to confidently infer its purpose.

However, it is worth noting that the servers stayed the same after tiktok-u[.]sbs was suspended by the registrar. Historical DNS resolution shows that the subdomains on locat[.]sbs are mapped to the same servers that were previously mapped to tiktok-u[.]sbs.

Tortoiseshell remains an active Iranian-nexus threat actor, and Group-IB research confirms that the group is actively expanding both its geographic reach and operational capabilities. The identification of infrastructure targeting Middle Eastern and European countries alongside continued development of tools such as the TWOSTROKE backdoor and SSH-based tunneling utilities demonstrates a threat actor that is steadily evolving its toolset and adapting its techniques to maintain access across a growing number of targets.

Organizations in the affected regions should treat this activity as an ongoing and escalating threat. Tortoiseshell’s affiliation with the IRGC, combined with its focus on defence, aerospace, and government-adjacent sectors, positions it as a group capable of enabling both espionage and disruptive operations in service of state objectives.

The broader regional threat landscape remains volatile. Given the fragile nature of current geopolitical conditions, cyber operations conducted by actors like Tortoiseshell are unlikely to change, since espionage doesn’t constitute pressure or escalation in the way a destructive/disruptive or kinetic operation would.

Continuous monitoring, proactive threat hunting, and intelligence sharing remain essential for organizations operating in targeted geographies and sectors.

Organizations can reduce exposure to recent Tortoiseshell / UNC1549 / Nimbus Manticore / Mirage Kitten operations by implementing the following measures.

An Advanced Persistent Threat (APT) is a stealthy, prolonged cyberattack conducted by a well-resourced group — often state- . APTs normally focus on performing continuous espionage, secretly stealing sensitive information, such as intellectual property, financial data, or government secrets.

A supply chain attack is a cyberattack that targets an organization indirectly by first compromising a vendor, supplier, or software component in its ecosystem. Supply chain attacks target software vendors, managed service providers, and SaaS platforms to reach downstream customers. When threat actors compromise a trusted supplier or integration point, they can leverage legitimate access, making detection more difficult than with a direct attack.

The research highlights a reverse SSH-based tunneling utility disguised as a Windows Terminal Server API (wtsapi32.dll) and an updated sample of the TWOSTROKE C++ backdoor. Both components enable attackers to execute shell commands, manage files, and route C2 traffic directly into compromised environments.

A reverse SSH tunnel is an encrypted connection initiated from inside an infected system outward to an attacker’s server. Cybercriminals exploit it by routing traffic sent to their C2 server back through this established connection, enabling them to bypass inbound firewalls and directly access compromised internal networks.

The group’s infrastructure and targeting profile span across countries in Europe and the Middle East. Specific targets include European nations such as the UK, France, Albania, and Belarus, alongside Middle Eastern regions including Israel, Turkey, and GCC member states.

neexportfolio[.]azurewebsites[.]net

neexportfolio[.]eastus.cloudapp.azure[.]com

bridge1.tiktok-u[.]sbs

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.