Nimbus Manticore Expands Cyber Espionage Toolkit
Iranian state-sponsored hackers deploy TWOSTROKE-like backdoor and new SSH tunneling utility.
1Who is Nimbus Manticore?
Nimbus Manticore is an Iranian state-sponsored cyber espionage group linked to the Islamic Revolutionary Guard Corps (IRGC). Also known as GalaxyGato, Mirage Kitten, and UNC1549, the group has been identified as one of the most active Iranian APT groups in 2026. It's associated with Tortoiseshell operations that primarily target defense, aerospace, and military organizations.
2Newly Discovered Threats
Group-IB researchers have uncovered new malware developed by Nimbus Manticore that resembles the known TWOSTROKE backdoor. This C++-based tool can collect system information, load DLLs, and manipulate files. The group also uses a new SSH-based tunneling utility to infiltrate targets across Europe and the Middle East.
3Targets and Geographic Spread
Analysis of Nimbus Manticore's infrastructure reveals the group primarily targets Middle Eastern countries but has recently expanded operations to European organizations. According to Kaspersky's latest report, the group also employs a new Windows backdoor called NightLedger and custom WebSocket tunneling tools named BridgeHead and ArcBridge.
4TWOSTROKE-like Backdoor
The newly discovered backdoor mimics the Windows terminal server SDK DLL (wtsapi32.dll). It establishes HTTPS connections to one of three hard-coded command-and-control (C2) servers to receive instructions. The malware can download/upload files, execute binaries/DLLs, gather host information, and delete specific files based on received commands.
5SSH Tunneling Utility
The group has developed a new reverse SSH tunneling tool that masquerades as Windows Terminal Server SDK API. It connects to operator infrastructure at IP 172.86.98[.]113 on port 443. This tunneling utility helps the group maintain persistent access to target networks.
6Dream Job Campaign
Nimbus Manticore is known for conducting job opportunity-themed social engineering attacks. Their Dream Job campaigns distribute malware, particularly targeting defense and aerospace industry employees. This method enables high-impact cyber espionage operations against strategic targets.
7Operational Longevity
The group has been active since at least 2018 and continuously develops new tools. Kaspersky's report indicates Nimbus Manticore is also active in attacks targeting South Asia and Africa. The group aims to expand its reach by constantly enhancing its toolkit and targeting methodology.
8Cybersecurity Warning
Experts warn that defense, aerospace, and critical infrastructure sectors should be particularly vigilant due to Nimbus Manticore's advanced toolset and broad geographic targeting. As a state-sponsored threat actor, the group continues to enhance its cyber espionage capabilities, posing a significant risk to international security.
Original article: The Hacker News — Nimbus Manticore Yeni Siber Casusluk Araçları Geliştiriyor