# Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT

> Imperial Kitten (aka Tortoiseshell, CURIUM, Crimson Sandstorm, UNC1549, Nimbus Manticore) is an Iranian state-sponsored, IRGC-linked espionage actor active since 2017 that targets aerospace, defense and IT organizations across the Middle East, North America, Europe and Asia-Pacific. It uses job-lure spearphishing, third-party/VDI access, DLL search-order hijacking, custom backdoors and tunnelers, and Azure/Cloudflare-fronted C2.

- **Published:** 2026-11-11T08:21:55Z
- **Last reviewed:** 2026-11-11T08:21:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5741
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5741.png
- **ID:** TL-2026-5741
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Bohrium (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Imperial Kitten is described by Picus Security (2026-11-11) as an Iranian state-sponsored APT linked to the IRGC and active since 2017. Picus reports that in April 2024 the US DOJ charged four Iranian nationals and OFAC sanctioned a Tehran-based IT front company (identified by Meta in July 2021). Aliases listed include Tortoiseshell, CURIUM, Crimson Sandstorm, Cuboid Sandstorm, DUSTYCAVE, TA456, Yellow Liderc, UNC1549 and Nimbus Manticore. Mandiant/Google tracks the UNC1549 cluster as a suspected Iran-nexus group and assesses the Tortoiseshell/IRGC link as suspected rather than confirmed; Check Point tracks overlapping activity as Nimbus Manticore, and treats the dxgi.dll cluster (linked to PRODAFT's Subtle Snail) as sharing code lineage with MiniJunk but using different command sets. Cluster overlaps between vendors should therefore be treated as assessed, not definitive.

Initial access relies on (1) job/recruitment lures: fake HR recruiters (often approached on LinkedIn, then moved to email), fake React-based career portals impersonating Boeing, Airbus, Rheinmetall, flydubai and Telespazio with per-victim pre-shared credentials, where a successful POST to /login-user delivers a ZIP (e.g. Survey.zip); (2) abuse of trusted relationships and compromised third-party vendor/contractor credentials to reach Citrix, VMware and Azure Virtual Desktop/Application sessions and break out to host systems; and (3) valid accounts and password spraying. After compromise the actor phishes IT staff internally using real password-reset pages and copied reset-request threads.

Execution and persistence rely on DLL search-order hijacking against legitimate binaries from Fortinet, VMware, Citrix, Microsoft and NVIDIA. The 2025 MiniJunk chain runs Setup.exe, which sideloads userenv.dll, launches SenseSampleUploader.exe and sideloads xmllite.dll, then persists under %LOCALAPPDATA%\Microsoft\MigAutoPlay\ with an HKCU Run key named MigAutoPlay. Payloads include the TWOSTROKE C++ backdoor (SSL over TCP/443; bot ID from XOR-encrypted FQDN), MINIBIKE/MiniJunk/MINIBUS backdoors (rotating 3-5 hardcoded Azure C2 hosts, wide-string reversal encoding, custom LLVM obfuscation), DEEPROOT (Golang Linux backdoor), LIGHTRAIL (SOCKS4a tunneler likely derived from Lastenzug, WebSocket on 443, path /news), POLLBLEND (C++ tunneler, POST /register/), GHOSTLINE (Go tunneler using go-yamux), a reverse-SSH utility masquerading as wtsapi32.dll, TRUSTTRAP (fake Outlook/Windows Security credential prompt, cleartext storage), DCSYNCER.SLICK (DCSync/Mimikatz-derived), CRASHPAD, SIGHTGRAB (screenshots to C:\Users\Public\Videos|Music) and MiniBrowse (Chrome/Edge credential stealer). Backdoors may beacon silently for months and are activated after remediation begins; ZEROTIER and NGROK are held in reserve.

Post-exploitation includes DCSync (sometimes under a reset DC computer account), Kerberoasting, RBCD abuse, vulnerable AD CS templates, RDP session hijacking, lateral movement over RDP, PowerShell Remoting, Atelier Web Remote Commander and SCCMVNC, SharePoint/Teams collection, and deletion of RDP history keys. Reverse SSH tunnels to port 443 limit host artifacts. C2 uses Azure Web Apps/cloudapp hosts and, since June 2025, Cloudflare plus Azure App Service, with servers placed in the target's country. Group-IB (2026-08-26) documents an updated TWOSTROKE and a reverse-SSH tool (both named wtsapi32.dll) plus a 26-label subdomain set on locat.sbs / tiktok-u.sbs resolving to ~26 IPs, whose purpose Group-IB states is unconfirmed. No CVEs are associated; severity is analyst-assigned.

## MITRE ATT&CK

- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027.007 Dynamic API Resolution
- T1070.007 Clear Network Connection History and Configurations
- T1553.002 Code Signing
- T1056.002 GUI Input Capture
- T1555.003 Credentials from Web Browsers
- T1003.006 DCSync
- T1110.003 Password Spraying
- T1558.003 Kerberoasting
- T1534 Internal Spearphishing
- T1563.002 RDP Hijacking
- T1113 Screen Capture
- T1213.002 Sharepoint
- T1071.001 Web Protocols
- T1008 Fallback Channels
- T1572 Protocol Tunneling
- T1132.001 Standard Encoding
- T1573.001 Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Imperial Kitten MiniJunk/TWOSTROKE DLL Side-Loading from User-Writable Paths** (`TL-2026-5741-SPL-001`)

Detects Sysmon image-load events where userenv.dll, xmllite.dll, wtsapi32.dll, dxgi.dll or VGAuth.dll (DLL names abused by Imperial Kitten / UNC1549 / Nimbus Manticore for T1574.001 search-order hijacking of legitimate signed binaries) are loaded from AppData, Public, ProgramData, Temp or Downloads instead of the Windows system directories, or where a loaded module matches a known TL-2026-5741 hash (reverse-SSH wtsapi32.dll, updated TWOSTROKE wtsapi32.dll, LIGHTRAIL, MiniBrowse, DCSYNCER.SLICK, CRASHPAD). System DLL names living in user-writable paths is a T1036.005 masquerading signal that is independent of any single C2 domain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1036.005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 ((ImageLoaded IN ("*\\userenv.dll","*\\xmllite.dll","*\\wtsapi32.dll","*\\dxgi.dll","*\\VGAuth.dll") AND ImageLoaded IN ("*\\AppData\\*","*\\Users\\Public\\*","*\\ProgramData\\*","*\\Temp\\*","*\\Downloads\\*") AND NOT ImageLoaded="C:\\Windows\\*") OR Hashes IN ("*d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b*","*597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437*","*b19bdfda0cd8e50f7b5968d39aa31449a9cf9b85b8d7e00e19400cf5734f70bf*","*95d246e4956ad5e6b167a3d9d939542d6d80ec7301f337e00bb109cc220432cf*","*10f16991665df69d1ccd5187e027cf3d*","*b2bd275f97cb95c7399065b57f90bb6c*")) | stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as dll_path values(Hashes) as hashes values(Signed) as signed by Computer, Image | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("userenv.dll", "xmllite.dll", "wtsapi32.dll", "dxgi.dll", "VGAuth.dll")
    and FolderPath has_any (@"\AppData\", @"\Users\Public\", @"\ProgramData\", @"\Temp\", @"\Downloads\")
    and not(FolderPath startswith @"C:\Windows\"))
    or SHA256 in~ ("d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b", "597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437", "b19bdfda0cd8e50f7b5968d39aa31449a9cf9b85b8d7e00e19400cf5734f70bf", "95d246e4956ad5e6b167a3d9d939542d6d80ec7301f337e00bb109cc220432cf")
    or MD5 in~ ("10f16991665df69d1ccd5187e027cf3d", "b2bd275f97cb95c7399065b57f90bb6c")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, FolderPath, SHA256, MD5
| order by Timestamp desc
```

### Sigma

```yaml
title: Imperial Kitten DLL Side-Loading of System DLL Names from User-Writable Paths
id: a3f1c2d4-5b6e-4f70-8a91-2c3d4e5f6071
status: experimental
description: Detects userenv.dll, xmllite.dll, wtsapi32.dll, dxgi.dll or VGAuth.dll loaded from user-writable directories (DLL search-order hijacking used by Imperial Kitten / UNC1549 / Nimbus Manticore MiniJunk and TWOSTROKE chains), or modules matching known TL-2026-5741 hashes.
references:
  - https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/
  - https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense
  - https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-evasion
  - attack.t1574.001
  - attack.t1036.005
logsource:
  category: image_load
  product: windows
detection:
  selection_name:
    ImageLoaded|endswith:
      - '\userenv.dll'
      - '\xmllite.dll'
      - '\wtsapi32.dll'
      - '\dxgi.dll'
      - '\VGAuth.dll'
  selection_path:
    ImageLoaded|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Temp\'
      - '\Downloads\'
  filter_system:
    ImageLoaded|startswith: 'C:\Windows\'
  selection_hash:
    Hashes|contains:
      - 'd23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b'
      - '597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437'
      - 'b19bdfda0cd8e50f7b5968d39aa31449a9cf9b85b8d7e00e19400cf5734f70bf'
      - '95d246e4956ad5e6b167a3d9d939542d6d80ec7301f337e00bb109cc220432cf'
      - '10f16991665df69d1ccd5187e027cf3d'
      - 'b2bd275f97cb95c7399065b57f90bb6c'
  condition: (selection_name and selection_path and not filter_system) or selection_hash
falsepositives:
  - Portable or per-user installed applications that legitimately ship their own copy of dxgi.dll or VGAuth.dll in AppData or ProgramData
  - Game launchers and graphics tooling that bundle dxgi.dll next to the executable
level: high

```

**Known false positives:**

- Portable or per-user installed software that ships its own dxgi.dll, VGAuth.dll or wtsapi32.dll in AppData/ProgramData
- Game launchers, graphics overlays and VDI/remote-access clients that bundle a private copy of dxgi.dll

**Tuning notes:** Allowlist known-good (Image, ImageLoaded) pairs after a 14-day baseline, and require Signed=false or an unexpected signer to raise fidelity. Enable Sysmon EventID 7 for these DLL names only to control volume. Prioritise hits where the host Image is a signed Fortinet, VMware, Citrix, Microsoft or NVIDIA binary sitting in a user-writable folder.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Imperial Kitten Fake Career Portal and Lookalike Phishing Domain Access (locked: unlock with TL Creds)
- Imperial Kitten Active Directory DCSync Replication by Non-Machine Account (locked: unlock with TL Creds)
- Imperial Kitten C2 and Tunneler Infrastructure Connections (Azure, Cloudflare-fronted, [indicator]) (locked: unlock with TL Creds)
- Imperial Kitten MiniJunk Execution Chain: Relocated SenseSampleUploader, MigAutoPlay Directory and ZIP-Extracted Setup.exe (locked: unlock with TL Creds)
- Imperial Kitten Kerberoasting via RC4 Service Ticket Requests (locked: unlock with TL Creds)
- Imperial Kitten RDP Session Hijacking via tscon and RDP History Deletion (locked: unlock with TL Creds)
- Imperial Kitten MigAutoPlay Run Key and Directory Persistence (locked: unlock with TL Creds)
- Imperial Kitten Reverse SSH Tunnel over TCP/443 to Known Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `172.86.98[.]113`
- Domain: `locat[.]sbs`
- File hash: `d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Imperial Kitten (Tortoiseshell) APT: TTPs, Malware, and Attack Simulation (Picus Security)](https://www.picussecurity.com/resource/blog/imperial-kitten-tortoiseshell-apt-ttps-malware-and-attack-simulation)
- [Tortoiseshell: New Toolset and Operational Infrastructure Exposed (Group-IB)](https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/)
- [Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem (Google Cloud)](https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense)
- [Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research)](https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/)
- [When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors (Google Cloud)](https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east)
- [Iranian Hacking Group Nimbus Manticore Expands European Targeting (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/iran-nimbus-manticore-european/)
- [Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe (Check Point Blog)](https://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/)
- [Malpedia: UNC1549 actor profile](https://malpedia.caad.fkie.fraunhofer.de/actor/unc1549)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5741