Nimbus Manticore Expands Iranian Cyber Espionage Campaign With New Malware
Cybersecurity researchers have uncovered new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored threat group associated with the Islamic Revolutionary Guard Corps (IRGC).
According to Group-IB, Nimbus Manticore is one of the most active Iranian APT groups observed in 2026. The group is also tracked under names including GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549.
The group has historically targeted defense, aerospace, IT services, and military organizations, particularly across the Middle East and the United States.
New Tortoiseshell Infrastructure Discovered
Group-IB identified infrastructure linked to Tortoiseshell, a threat cluster associated with Nimbus Manticore, across parts of Europe and the Middle East.
The researchers also discovered two previously undocumented tools:
- An SSH-based reverse tunneling utility
- A C++ backdoor with similarities to the previously known TWOSTROKE malware
The discoveries indicate that the threat actor continues to develop its tooling and expand its infrastructure to maintain long-term access to targeted systems.
SSH Tunnel Masquerades as Windows Component
One of the newly identified tools disguises itself as a legitimate Windows Terminal Server SDK API.
Behind the disguise, the malware establishes a reverse SSH connection to attacker-controlled infrastructure at:
172.86.98[.]113:443
Using port 443 can help the traffic blend into normal HTTPS-related network activity, while the SSH tunnel provides attackers with a channel for remote communication.
New Backdoor Mimics wtsapi32.dll
Researchers also discovered a C++ backdoor that shares characteristics with TWOSTROKE, a malware family previously associated with the group.
The malware masquerades as the legitimate Windows library wtsapi32.dll, a technique that can help malicious files appear legitimate during execution or investigation.
The backdoor connects to one of three hard-coded command-and-control (C2) servers using HTTPS and waits for instructions from the attackers.
Once a command is received, the malware extracts the requested operation and creates a new worker thread to execute it.
Capabilities of the Backdoor
The malware provides attackers with several capabilities, including:
- Downloading files
- Uploading files
- Executing binaries
- Executing DLLs
- Collecting system information
- Listing directories
- Deleting files
These capabilities allow the attackers to perform reconnaissance, manipulate files, execute additional payloads, and maintain control over compromised systems.
Connection to NightLedger Campaign
The findings add to recent research from Kaspersky, which documented Nimbus Manticore's use of a Windows backdoor called NightLedger along with custom WebSocket tunneling tools known as BridgeHead and ArcBridge.
Those tools were used to maintain persistent access to compromised systems during campaigns targeting organizations across the Middle East, Africa, and South Asia.
Nimbus Manticore has also been linked to Dream Job-style attacks, where victims are approached with fake employment opportunities and subsequently targeted with malicious tools.
Expanding Targeting and Evolving Toolset
Group-IB said the newly discovered infrastructure suggests that the group's targeting may be expanding across Middle Eastern and European countries.
The continued development of tools such as the TWOSTROKE-like backdoor and SSH tunneling utilities shows that Nimbus Manticore is adapting its techniques to maintain access to an increasing number of targets.
The activity highlights how Iranian state-sponsored groups continue to rely on custom malware, legitimate-looking Windows components, encrypted communications, and tunneling infrastructure to maintain stealthy access during cyber espionage operations.
