Nimbus Manticore, an Iranian IRGC-linked threat group, has been tied to newly discovered infrastructure and previously undocumented malware used for espionage campaigns across the Middle East and Europe. Researchers also found a reverse SSH tunneling tool and a C++ backdoor that overlaps with TWOSTROKE, showing the group continues to expand and refine its toolset. #NimbusManticore #Tortoiseshell #TWOSTROKE #NightLedger #BridgeHead #ArcBridge
Keypoints
- Nimbus Manticore is an Iranian state-sponsored group linked to the IRGC.
- Group-IB uncovered new Tortoiseshell infrastructure across Europe and the Middle East.
- The group uses a reverse SSH tunneling tool disguised as Windows Terminal Server SDK API.
- A new C++ backdoor shares similarities with TWOSTROKE and supports file and system operations.
- Recent activity shows continued evolution of tools to maintain persistent access to targeted entities.
Read More: https://thehackernews.com/2026/08/nimbus-manticore-expands-toolset-with.html