Loading story…
Group-IB identified new malware and infrastructure linked to the Iranian-associated cyber-espionage group Tortoiseshell. The newly found tools include a C++ backdoor resembling TWOSTROKE/TwoStroke and a reverse SSH tunneling utility that can provide persistent remote access and facilitate movement into internal networks. Both samples masquerade as the legitimate Windows wtsapi32.dll and appear designed for DLL search-order hijacking; the backdoor supports broad remote-control capabilities.
The group’s associated infrastructure includes locat[.]sbs and tiktok-u[.]sbs, with region-themed subdomains and servers labeled uk1 and uk2 on UK-based IP addresses, alongside infrastructure tied to Belgium, Saudi Arabia, and the United Arab Emirates. These findings may indicate an operational expansion across Europe and the Middle East, but researchers have not confirmed the infrastructure’s use against specific targets.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group previously documented the TWOSTROKE malware, which Group-IB later found to resemble a newly identified Tortoiseshell backdoor.
Tortoiseshell, an Iranian-linked cyber-espionage group also tracked by Kaspersky as Mirage Kitten, has been active since at least 2018 and historically targeted defense, aerospace, IT, and military organizations in the Middle East and United States.
Researchers identified NightLedger, a previously undocumented backdoor deployed by the Iranian-linked Nimbus Manticore/Tortoiseshell cluster. The implant supports file manipulation and remote command execution, while the group also used custom WebSocket tunneling tools to maintain access to compromised systems.
Group-IB linked locat[.]sbs and tiktok-u[.]sbs to known Tortoiseshell command-and-control infrastructure, identifying country-themed subdomains and servers associated with Britain, Belgium, Saudi Arabia, and the UAE. The researchers said the infrastructure's actual use and intended targets remain unconfirmed.
Group-IB identified a C++ backdoor disguised as wtsapi32.dll and apparently intended for DLL search-order hijacking. The HTTPS-based implant supports command execution, file transfer, in-memory DLL execution, directory listing, and file deletion.
Group-IB identified a reverse SSH tunneling utility masquerading as wtsapi32.dll that uses the Windows OpenSSH client to connect to attacker infrastructure and route traffic into compromised networks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 90 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcescworld.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourceinfosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026
An Iran-linked espionage cluster tracked as **Greenbug** and **OilRig/APT34** targeted telecommunications providers in South Asia while relying on a broader toolkit built for stealthy persistence, credential theft, and covert command-and-control. Symantec reported intrusions spanning at least April 2019 to April 2020 in which attackers used email lures and malicious `CHM` and `HTA` files for initial access, then moved through victim networks with tools including **Covenant**, **Cobalt Strike**, **Mimikatz**, **Plink**, **Bitvise**, **PowerShell**, **BITSAdmin**, and webshells. In one intrusion that lasted about six months, the operators focused on harvesting credentials, maintaining privileged access, tunneling into internal systems, and testing access to database servers inside telecom environments. Multiple reports tie that activity to established OilRig tradecraft, including Exchange-focused `.NET` webshells planted under `/owa/auth/`, scheduled-task persistence, and extensive use of **DNS tunneling** to hide C2 and exfiltration traffic. Unit 42 and IronNet described tools such as **ISMAgent**, **Helminth**, **ALMACommunicator**, **BONDUPDATER**, **QUADAGENT**, and **PoisonFrog**, which encoded tasking and stolen data into crafted DNS subdomains and used `A`, `AAAA`, or `TXT` responses to pass commands. NSFOCUS said a leaked APT34 toolkit exposed PowerShell RATs, webshells, the **Webmask** DNS/HTTP hijacking tool, and more than 12,000 weak passwords, while earlier ClearSky reporting showed Greenbug delivering **ISMAgent** through an Office exploit for `CVE-2017-0199` and `certutil.exe`-decoded payloads, underscoring a long-running pattern of low-profile access operations and intelligence collection.
Aug 15, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026