The latest findings around Nimbus Manticore are significant because they show how mature threat actors continue to evolve beyond simply developing new malware. The Iranian state-sponsored group, which has also been tracked under names such as UNC1549, Smoke Sandstorm, Subtle Snail and Mirage Kitten, is expanding both its operational infrastructure and the tools it uses to maintain covert access inside compromised environments. Researchers have identified additional infrastructure across Europe and the Middle East, along with a previously undocumented SSH-based tunneling utility and a C++ backdoor that shares similarities with the TWOSTROKE malware family. This combination of persistent access tools, covert tunneling mechanisms and geographically distributed infrastructure indicates an operation designed for long-term espionage rather than short-lived opportunistic compromise.

Nimbus Manticore is associated with the broader Tortoiseshell activity cluster, which has been operating since at least 2018 and has historically targeted defense organizations, aerospace companies, military entities and IT service providers. The group has also previously relied on highly targeted social-engineering campaigns, including fake employment opportunities designed to convince selected individuals to execute malicious files or interact with attacker-controlled infrastructure. This is particularly relevant because sophisticated attackers rarely depend on a single technique. Initial access may come through social engineering, but once inside the environment, the operational priority changes to persistence, reconnaissance, lateral movement and maintaining reliable command-and-control channels without attracting unnecessary attention.

One of the most interesting components discovered in the latest research is a reverse SSH tunneling utility. The malware reportedly disguises itself as part of the Windows Terminal Server SDK while establishing an outbound SSH connection to attacker-controlled infrastructure over port 443. Using port 443 is strategically useful because HTTPS traffic is almost universally permitted through enterprise firewalls, and encrypted SSH communication traversing the same port can blend into an environment dominated by legitimate encrypted web traffic. This demonstrates an important limitation of traditional network-security policies based primarily on ports and protocols. Allowing TCP port 443 does not mean that everything traversing that port is legitimate HTTPS traffic. A firewall that makes decisions based only on destination port may permit an attacker to establish an entirely different encrypted protocol through what administrators believe is ordinary web access.

Reverse tunneling is particularly valuable to attackers because it changes the direction in which connectivity is established. Instead of requiring an external attacker to initiate a connection toward the compromised system, which would often be blocked by perimeter firewalls and NAT devices, the compromised endpoint creates an outbound connection to the attacker. Since outbound connectivity is usually far less restricted than inbound traffic, the tunnel can create a communication path through an otherwise well-defended perimeter. Once established, such tunnels can be used for command execution, remote access, proxying traffic or accessing systems that are not directly reachable from the internet. This is why outbound traffic control deserves as much attention as inbound firewall policy, although organizations still routinely configure the perimeter like attackers politely agree to enter only through the front door.

The second newly identified component is a C++ backdoor that appears to overlap technically with TWOSTROKE, another malware family previously associated with the same threat actor. The malware masquerades as the legitimate Windows terminal services library wtsapi32.dll and communicates with hard-coded command-and-control servers over HTTPS. Masquerading malware as a familiar Windows DLL is a well-established technique because legitimate-looking file names can reduce suspicion during manual investigation and may survive simplistic security controls that rely excessively on filenames rather than behavioral analysis. Once connected to its command-and-control infrastructure, the backdoor can receive instructions and execute them through separate worker threads.

The backdoor provides attackers with a practical set of post-compromise capabilities. It can collect information about the infected system, enumerate directories, upload and download files, execute binaries, load DLLs and remove files from the compromised machine. Individually, none of these functions is particularly exotic. Their importance lies in how they support an attacker throughout the intrusion lifecycle. System reconnaissance allows the operator to determine whether the victim is valuable, file-transfer functionality enables additional malware or tools to be delivered, DLL execution provides flexible code execution, and file deletion can assist both operational cleanup and anti-forensic activity. A small and dependable backdoor often provides more operational value to an espionage actor than an unnecessarily complicated malware framework that creates additional opportunities for detection.

The use of HTTPS for command-and-control communication adds another defensive challenge. Most modern organizations cannot simply block encrypted outbound web traffic, and inspecting it at scale can introduce operational, privacy and performance considerations. As a result, security teams need to look beyond whether a connection is encrypted and instead evaluate where the traffic is going, which process initiated it, whether the destination is expected, how frequently communication occurs and whether the connection pattern is consistent with normal application behavior. An unknown DLL or unusual executable repeatedly initiating encrypted connections to infrastructure never previously contacted by the organization should receive considerably more attention than an ordinary browser session, even if both technically appear as encrypted traffic on port 443.

The discoveries also build upon previous reporting on Nimbus Manticore that identified another Windows backdoor known as NightLedger along with two custom WebSocket tunneling tools, BridgeHead and ArcBridge. Those tools were reportedly used to maintain persistent and covert connectivity in compromises affecting organizations across the Middle East, Africa and South Asia. The addition of reverse SSH tunneling and another TWOSTROKE-like backdoor suggests the group is intentionally maintaining multiple communication mechanisms rather than relying on a single command-and-control architecture.

Maintaining several tunneling and backdoor technologies offers attackers significant operational resilience. If defenders detect and block one command-and-control mechanism, another may continue functioning. WebSocket traffic can resemble legitimate web-application communication, HTTPS backdoors can blend into ordinary encrypted traffic, and SSH tunnels can provide a robust remote-access channel. This diversification therefore acts almost like redundancy in legitimate network engineering, except the people designing the redundancy are unfortunately trying to remain inside someone else's infrastructure.

The expanding infrastructure identified across Middle Eastern and European countries also deserves attention. Distributed command-and-control infrastructure can make attribution and blocking substantially more difficult. Security teams frequently respond to threat intelligence by blocking known malicious IP addresses or domains, but sophisticated adversaries expect these indicators to become unusable once discovered. Infrastructure can therefore be replaced, redirected or abandoned quickly. Organizations should certainly incorporate current indicators of compromise into security controls, but indicator-based blocking should be treated as one defensive layer rather than the primary detection strategy.

Behavior-based detection is considerably more resilient. Security teams should monitor for unusual processes establishing SSH sessions, unexpected outbound connections on port 443 that do not behave like TLS, suspicious execution of DLLs using legitimate Windows utilities, newly created persistence mechanisms, abnormal child processes generated by service applications, and binaries masquerading as legitimate Windows components outside their normal filesystem locations. The legitimate wtsapi32.dll, for example, has expected locations and digital-signature characteristics. A similarly named DLL appearing inside an application directory, temporary directory or user-writable location should warrant investigation.

Endpoint telemetry is therefore particularly important when dealing with malware such as this. Traditional antivirus detection may identify known samples, but custom malware frequently changes between campaigns. Endpoint Detection and Response systems can instead focus on behavior, such as a process loading an unusual DLL, spawning execution threads, making persistent outbound connections, modifying startup locations or launching binaries retrieved from external servers. Correlating endpoint events with firewall, DNS, proxy and network-flow information can make seemingly harmless individual events much more meaningful.

The SSH tunneling component also reinforces the importance of protocol-aware network security. Enterprises should consider whether outbound SSH traffic is genuinely required from ordinary user workstations. In many environments, developers or administrators may need SSH access, but thousands of employee endpoints generally do not. Restricting SSH connectivity to approved administrative systems significantly reduces the opportunity for malicious tunneling. Where SSL inspection or advanced application identification is available and appropriate, organizations can also detect cases where SSH is being carried over unusual ports instead of blindly classifying everything using TCP 443 as HTTPS.

DNS and destination reputation can provide another useful layer of visibility, but security teams should be careful not to depend exclusively on previously known malicious infrastructure. Advanced persistent threat groups routinely rotate infrastructure and may use newly registered or previously clean servers. Baseline analysis can therefore be valuable. If an engineering workstation that normally communicates only with a predictable set of business services suddenly begins maintaining long-lived encrypted connections to an unfamiliar hosting provider, that behavior may be more useful as a detection signal than whether the destination already appears on a threat-intelligence blacklist.

The targeting profile also matters. Defense, aerospace, telecommunications, government, military and IT service organizations naturally possess information valuable to state-sponsored espionage operations. IT service providers are particularly attractive because compromise of one provider may provide access to multiple downstream customers. Organizations operating in these sectors should therefore assume that targeted social engineering will be tailored to employees' professional roles rather than arriving as obviously fraudulent mass phishing. A convincing employment offer sent to an engineer or researcher may contain enough legitimate contextual information to survive ordinary suspicion.

This is why security-awareness programs should move beyond repeatedly telling users not to click suspicious links. Sophisticated threat actors may create credible identities, conduct extended conversations, reference genuine industry information and send technically plausible documents or software. Users handling sensitive technical or governmental information should know that unsolicited job offers, consulting opportunities and recruitment approaches may form part of targeted intelligence operations. Suspicious files should be isolated and analyzed even when the person sending them appears professional and knowledgeable.

For organizations already investigating possible Nimbus Manticore activity, defenders should look for persistence artifacts, suspicious DLLs, unexplained HTTPS and SSH connections, tunneling behavior and unusual file-transfer activity. Historical network telemetry should also be retained whenever possible because command-and-control infrastructure may only be identified months after initial compromise. Once new attacker infrastructure becomes known, historical DNS and flow records can help determine whether systems communicated with it before defenders understood its significance.

Threat hunting should not stop after finding the initially infected machine. State-sponsored actors generally seek valuable information rather than simply proving they achieved code execution. Investigators should determine what credentials the compromised endpoint could access, which internal systems it communicated with, whether privileged sessions occurred, whether sensitive documents were accessed and whether additional persistence mechanisms were deployed elsewhere in the environment. Reimaging one endpoint while leaving stolen credentials and secondary footholds untouched can provide a comforting closure report while accomplishing remarkably little.

Nimbus Manticore's expanding toolkit also reflects a broader trend among advanced persistent threat groups: the increasing importance of covert network access tools. Backdoors remain useful, but tunnelers provide something potentially more valuable, a way to transform the compromised machine into an access point within the victim's internal network. Once that capability exists, an attacker can potentially interact with internal services through the compromised host rather than deploying malware onto every target. This reduces the attacker's footprint and can make detection more difficult.

Network segmentation therefore becomes an important defensive control. A compromised workstation should not automatically provide unrestricted access to servers, administrative interfaces, databases and sensitive management networks. Segmentation combined with identity-aware access controls can limit the value of a tunneling implant by reducing what the compromised endpoint is capable of reaching. Even if the attacker establishes a functioning tunnel, the reachable network should remain constrained by policy.

The campaign also demonstrates why threat intelligence should be used to understand attacker behavior rather than merely produce IP-address blocklists. Indicators such as command-and-control servers are temporary. Techniques such as masquerading malware as legitimate Windows libraries, establishing reverse tunnels, using encrypted command-and-control channels and maintaining multiple persistence mechanisms are much more durable. Security programs built around understanding these behavioral patterns are therefore likely to remain effective longer than controls focused exclusively on today's malicious infrastructure.

The broader takeaway from Nimbus Manticore is that modern espionage operations increasingly resemble professionally engineered platforms. Operators maintain alternative communication channels, specialized backdoors, tunneling mechanisms, geographically distributed infrastructure and carefully designed social-engineering campaigns. Defending against such adversaries therefore requires equally layered controls: endpoint monitoring, application-aware firewalls, outbound-access restrictions, network segmentation, DNS visibility, identity security, threat hunting and user awareness must operate together.

Most importantly, organizations should stop viewing successful perimeter defense as evidence that an attacker cannot establish remote access. Reverse SSH tunnels, WebSockets and HTTPS-based command-and-control channels demonstrate precisely why that assumption is obsolete. Modern attackers often enter through an endpoint and then make the connection outward themselves. The security question is therefore no longer simply, “Who is trying to connect to us?” It is increasingly, “Why is this system connecting there, which application initiated the connection, what protocol is actually travelling through it, and what can that endpoint reach once the connection is established?” Those are considerably harder questions, inconveniently enough, but they are also the ones modern network security actually needs to answer.

Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC). Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026. Nimbus Manticore (aka

Source: Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler via The Hacker News — published 26 Aug 2026.