Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5741 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Imperial Kitten MiniJunk/TWOSTROKE DLL Side-Loading from User-Writable Paths

Detects Sysmon image-load events where userenv.dll, xmllite.dll, wtsapi32.dll, dxgi.dll or VGAuth.dll (DLL names abused by Imperial Kitten / UNC1549 / Nimbus Manticore for T1574.001 search-order hijacking of legitimate signed binaries) are loaded from AppData, Public, ProgramData, Temp or Downloads instead of the Windows system directories, or where a loaded module matches a known TL-2026-5741 hash (reverse-SSH wtsapi32.dll, updated TWOSTROKE wtsapi32.dll, LIGHTRAIL, MiniBrowse, DCSYNCER.SLICK, CRASHPAD). System DLL names living in user-writable paths is a T1036.005 masquerading signal that is independent of any single C2 domain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.001, T1036.005
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 ((ImageLoaded IN ("*\\userenv.dll","*\\xmllite.dll","*\\wtsapi32.dll","*\\dxgi.dll","*\\VGAuth.dll") AND ImageLoaded IN ("*\\AppData\\*","*\\Users\\Public\\*","*\\ProgramData\\*","*\\Temp\\*","*\\Downloads\\*") AND NOT ImageLoaded="C:\\Windows\\*") OR Hashes IN ("*d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b*","*597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437*","*b19bdfda0cd8e50f7b5968d39aa31449a9cf9b85b8d7e00e19400cf5734f70bf*","*95d246e4956ad5e6b167a3d9d939542d6d80ec7301f337e00bb109cc220432cf*","*10f16991665df69d1ccd5187e027cf3d*","*b2bd275f97cb95c7399065b57f90bb6c*")) | stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as dll_path values(Hashes) as hashes values(Signed) as signed by Computer, Image | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("userenv.dll", "xmllite.dll", "wtsapi32.dll", "dxgi.dll", "VGAuth.dll")
    and FolderPath has_any (@"\AppData\", @"\Users\Public\", @"\ProgramData\", @"\Temp\", @"\Downloads\")
    and not(FolderPath startswith @"C:\Windows\"))
    or SHA256 in~ ("d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b", "597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437", "b19bdfda0cd8e50f7b5968d39aa31449a9cf9b85b8d7e00e19400cf5734f70bf", "95d246e4956ad5e6b167a3d9d939542d6d80ec7301f337e00bb109cc220432cf")
    or MD5 in~ ("10f16991665df69d1ccd5187e027cf3d", "b2bd275f97cb95c7399065b57f90bb6c")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, FolderPath, SHA256, MD5
| order by Timestamp desc

Sigma

title: Imperial Kitten DLL Side-Loading of System DLL Names from User-Writable Paths
id: a3f1c2d4-5b6e-4f70-8a91-2c3d4e5f6071
status: experimental
description: Detects userenv.dll, xmllite.dll, wtsapi32.dll, dxgi.dll or VGAuth.dll loaded from user-writable directories (DLL search-order hijacking used by Imperial Kitten / UNC1549 / Nimbus Manticore MiniJunk and TWOSTROKE chains), or modules matching known TL-2026-5741 hashes.
references:
  - https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/
  - https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense
  - https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-evasion
  - attack.t1574.001
  - attack.t1036.005
logsource:
  category: image_load
  product: windows
detection:
  selection_name:
    ImageLoaded|endswith:
      - '\userenv.dll'
      - '\xmllite.dll'
      - '\wtsapi32.dll'
      - '\dxgi.dll'
      - '\VGAuth.dll'
  selection_path:
    ImageLoaded|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Temp\'
      - '\Downloads\'
  filter_system:
    ImageLoaded|startswith: 'C:\Windows\'
  selection_hash:
    Hashes|contains:
      - 'd23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b'
      - '597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437'
      - 'b19bdfda0cd8e50f7b5968d39aa31449a9cf9b85b8d7e00e19400cf5734f70bf'
      - '95d246e4956ad5e6b167a3d9d939542d6d80ec7301f337e00bb109cc220432cf'
      - '10f16991665df69d1ccd5187e027cf3d'
      - 'b2bd275f97cb95c7399065b57f90bb6c'
  condition: (selection_name and selection_path and not filter_system) or selection_hash
falsepositives:
  - Portable or per-user installed applications that legitimately ship their own copy of dxgi.dll or VGAuth.dll in AppData or ProgramData
  - Game launchers and graphics tooling that bundle dxgi.dll next to the executable
level: high

Known false positives:

• Portable or per-user installed software that ships its own dxgi.dll, VGAuth.dll or wtsapi32.dll in AppData/ProgramData
• Game launchers, graphics overlays and VDI/remote-access clients that bundle a private copy of dxgi.dll

Tuning notes: Allowlist known-good (Image, ImageLoaded) pairs after a 14-day baseline, and require Signed=false or an unexpected signer to raise fidelity. Enable Sysmon EventID 7 for these DLL names only to control volume. Prioritise hits where the host Image is a signed Fortinet, VMware, Citrix, Microsoft or NVIDIA binary sitting in a user-writable folder.

• 🔒 Imperial Kitten Fake Career Portal and Lookalike Phishing Domain Access · unlock with TL Creds
• 🔒 Imperial Kitten Active Directory DCSync Replication by Non-Machine Account · unlock with TL Creds
• 🔒 Imperial Kitten C2 and Tunneler Infrastructure Connections (Azure, Cloudflare-fronted, [indicator]) · unlock with TL Creds
• 🔒 Imperial Kitten MiniJunk Execution Chain: Relocated SenseSampleUploader, MigAutoPlay Directory and ZIP-Extracted Setup.exe · unlock with TL Creds
• 🔒 Imperial Kitten Kerberoasting via RC4 Service Ticket Requests · unlock with TL Creds
• 🔒 Imperial Kitten RDP Session Hijacking via tscon and RDP History Deletion · unlock with TL Creds
• 🔒 Imperial Kitten MigAutoPlay Run Key and Directory Persistence · unlock with TL Creds
• 🔒 Imperial Kitten Reverse SSH Tunnel over TCP/443 to Known Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5741.

Sample indicators (3 of 30)

• IP address: 172.86.98[.]113
• Domain: locat[.]sbs
• File hash: d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Technical analysis

Imperial Kitten is described by Picus Security (2026-11-11) as an Iranian state-sponsored APT linked to the IRGC and active since 2017. Picus reports that in April 2024 the US DOJ charged four Iranian nationals and OFAC sanctioned a Tehran-based IT front company (identified by Meta in July 2021). Aliases listed include Tortoiseshell, CURIUM, Crimson Sandstorm, Cuboid Sandstorm, DUSTYCAVE, TA456, Yellow Liderc, UNC1549 and Nimbus Manticore. Mandiant/Google tracks the UNC1549 cluster as a suspected Iran-nexus group and assesses the Tortoiseshell/IRGC link as suspected rather than confirmed; Check Point tracks overlapping activity as Nimbus Manticore, and treats the dxgi.dll cluster (linked to PRODAFT's Subtle Snail) as sharing code lineage with MiniJunk but using different command sets. Cluster overlaps between vendors should therefore be treated as assessed, not definitive.

Initial access relies on (1) job/recruitment lures: fake HR recruiters (often approached on LinkedIn, then moved to email), fake React-based career portals impersonating Boeing, Airbus, Rheinmetall, flydubai and Telespazio with per-victim pre-shared credentials, where a successful POST to /login-user delivers a ZIP (e.g. Survey.zip); (2) abuse of trusted relationships and compromised third-party vendor/contractor credentials to reach Citrix, VMware and Azure Virtual Desktop/Application sessions and break out to host systems; and (3) valid accounts and password spraying. After compromise the actor phishes IT staff internally using real password-reset pages and copied reset-request threads.

Execution and persistence rely on DLL search-order hijacking against legitimate binaries from Fortinet, VMware, Citrix, Microsoft and NVIDIA. The 2025 MiniJunk chain runs Setup.exe, which sideloads userenv.dll, launches SenseSampleUploader.exe and sideloads xmllite.dll, then persists under %LOCALAPPDATA%\Microsoft\MigAutoPlay\ with an HKCU Run key named MigAutoPlay. Payloads include the TWOSTROKE C++ backdoor (SSL over TCP/443; bot ID from XOR-encrypted FQDN), MINIBIKE/MiniJunk/MINIBUS backdoors (rotating 3-5 hardcoded Azure C2 hosts, wide-string reversal encoding, custom LLVM obfuscation), DEEPROOT (Golang Linux backdoor), LIGHTRAIL (SOCKS4a tunneler likely derived from Lastenzug, WebSocket on 443, path /news), POLLBLEND (C++ tunneler, POST /register/), GHOSTLINE (Go tunneler using go-yamux), a reverse-SSH utility masquerading as wtsapi32.dll, TRUSTTRAP (fake Outlook/Windows Security credential prompt, cleartext storage), DCSYNCER.SLICK (DCSync/Mimikatz-derived), CRASHPAD, SIGHTGRAB (screenshots to C:\Users\Public\Videos|Music) and MiniBrowse (Chrome/Edge credential stealer). Backdoors may beacon silently for months and are activated after remediation begins; ZEROTIER and NGROK are held in reserve.

Post-exploitation includes DCSync (sometimes under a reset DC computer account), Kerberoasting, RBCD abuse, vulnerable AD CS templates, RDP session hijacking, lateral movement over RDP, PowerShell Remoting, Atelier Web Remote Commander and SCCMVNC, SharePoint/Teams collection, and deletion of RDP history keys. Reverse SSH tunnels to port 443 limit host artifacts. C2 uses Azure Web Apps/cloudapp hosts and, since June 2025, Cloudflare plus Azure App Service, with servers placed in the target's country. Group-IB (2026-08-26) documents an updated TWOSTROKE and a reverse-SSH tool (both named wtsapi32.dll) plus a 26-label subdomain set on locat.sbs / tiktok-u.sbs resolving to ~26 IPs, whose purpose Group-IB states is unconfirmed. No CVEs are associated; severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 DCSync; T1056.002 GUI Input Capture; T1110.003 Password Spraying; T1555.003 Credentials from Web Browsers; T1558.003 Kerberoasting

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1132.001 Standard Encoding; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography

Defense Evasion

T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1070.007 Clear Network Connection History and Configurations

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship; T1566.002 Spearphishing Link

Collection

T1113 Screen Capture; T1213.002 Sharepoint

Lateral Movement

T1534 Internal Spearphishing; T1563.002 RDP Hijacking

Persistence

T1547.001 Registry Run Keys / Startup Folder

defense-impairment

T1553.002 Code Signing

stealth

T1574.001 DLL

Reconnaissance

T1598.003 Spearphishing Link

Remediation

Patches

• No CVE or vendor patch is associated with this actor; mitigation is configuration and detection based

Immediate actions

• Block and alert on the listed domains, IPs and file hashes; validate defanged-typo domains before blocking
• Hunt for HKCU Run value MigAutoPlay and %LOCALAPPDATA%\Microsoft\MigAutoPlay\ containing userenv.dll/MigAutoPlay.exe
• Hunt for wtsapi32.dll, VGAuth.dll, dxgi.dll, xmllite.dll or userenv.dll loaded from non-standard paths next to legitimate signed binaries
• Hunt for ssh.exe launched with -R and outbound port 443 to non-corporate hosts, and for ZeroTier/ngrok installs
• Reset credentials for accounts exposed to TRUSTTRAP-style prompts and audit third-party vendor accounts and VDI access
• Do not rely on a single remediation pass: assume dormant backdoors and parallel access paths

Workarounds

• Block newly registered career-themed lookalike domains at the proxy/DNS layer
• Disable or restrict SCCM Remote Control and RDP drive/clipboard redirection from virtualized sessions where not required

Longer-term hardening

• Enforce phishing-resistant MFA and conditional access on Citrix, VMware, Azure Virtual Desktop and vendor access
• Restrict outbound SSH and unmanaged WebSocket/azurewebsites.net traffic from workstations and servers
• Deploy EDR with DLL side-loading and unsigned-module-load behavioral detections
• Harden Active Directory: monitor DCSync replication, Kerberoasting, RBCD changes, AD CS templates and domain controller account password resets
• Train staff in aerospace/defense on fake recruiter and career-portal lures

Affected and fixed versions

• Microsoft — Windows endpoints and Active Directory (DLL sideloading, DCSync, RDP)
  Vulnerable versions: Not version-specific
• Citrix / VMware / Microsoft Azure — Virtual desktop and remote access services abused via third-party credentials
  Vulnerable versions: Not version-specific; abuse of valid access
• Microsoft — Azure App Service / cloudapp hosting abused for C2
  Vulnerable versions: Not version-specific

Timeline

• 2017-01-01 Activity attributed to the group begins (year only per Picus); 2017-2018 supply chain attacks on Saudi IT providers.
• 2021-07-01 Meta removes ~200 fake accounts used in social media catfishing of US military personnel and contractors and identifies a Tehran-based IT front company (day not stated; month per Picus).
• 2023-10-01 Israel-Hamas war-themed lures impersonating 'Bring Them Home Now' observed (month per Picus).
• 2024-02-27 Google Cloud/Mandiant publishes 'When Cats Fly' on UNC1549 targeting Israeli and Middle East aerospace and defense with MINIBIKE/MINIBUS and Azure C2.
• 2024-04-01 US DOJ charges four Iranian nationals and OFAC sanctions the group's front company (month per Picus).
• 2025-06-01 C2 re-architected to combine Cloudflare and Azure App Service; MiniJunk samples deployed during the twelve-day Israel-Iran conflict (per Check Point/Picus).
• 2025-09-22 Check Point Research publishes Nimbus Manticore report: MiniJunk, MiniBrowse, fake Boeing/Airbus/Rheinmetall career portals, targeting of Denmark, Sweden and Portugal.
• 2025-11-17 Google Cloud publishes UNC1549 TTP analysis covering TWOSTROKE, LIGHTRAIL, DEEPROOT, GHOSTLINE, POLLBLEND, third-party access and post-compromise AD abuse.
• 2026-02-01 Trojanized Zoom installer with valid digital certificates reported as 'Operation Epic Fury' (month per Picus; not independently verified).
• 2026-08-26 Group-IB publishes updated TWOSTROKE and reverse-SSH toolset and locked-ioc-30 / locked-ioc-29 infrastructure.
• 2026-11-11 Picus Security publishes Imperial Kitten profile with TTPs, malware and attack simulation mapping.

Sources cited

• Tortoiseshell: New Toolset and Operational Infrastructure Exposed (Group-IB) group-ib.com · Research · 2026-08-26
• Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem (Google Cloud) Google Cloud · Research · 2025-11-17
• Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research) Check Point Research · Research · 2025-09-22
• When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors (Google Cloud) Google Cloud · Research · 2024-02-27
• Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe (Check Point Blog) Check Point · Vendor report · 2025-09-22
• Malpedia: UNC1549 actor profile malpedia.caad.fkie.fraunhofer.de · Research · 2026-01-01
• Imperial Kitten (Tortoiseshell) APT: TTPs, Malware, and Attack Simulation (Picus Security) picussecurity.com · Blog · 2026-11-11
• Iranian Hacking Group Nimbus Manticore Expands European Targeting (Infosecurity Magazine) infosecurity-magazine.com · News · 2025-09-22

More in apt

• Iran-Backed Network (IRGC / Kataib Hezbollah / HAYI) Directed London and European Attacks over FaceTime
• North Korean Contagious Interview (WaterPlum) Campaign Compromises 30,000+ Devices, Steals $10.71M in Crypto
• Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures
• Bitget Hot/Warm Wallet Theft (~$387M) Attributed to North Korea-Linked Actors: Security-Tooling Compromise, Forged Withdrawals and Cross-Chain Laundering
• Beyond Lazarus: Organization of DPRK Cyber Capabilities (GRIB/NIA structure, six Lazarus sub-clusters, fake IT worker and laundering ecosystem)

More from Bohrium

• Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat RATs against aviation and FinTech via fake-recruiter coding challenges
• Tortoiseshell (Mirage Kitten / UNC1549 / Nimbus Manticore): New Toolset (TWOSTROKE Backdoor, Reverse SSH Tunnel) and Expanded Infrastructure