Nimbus Manticore Adds TWOSTROKE-Like Backdoor and Reverse SSH Tunneler
Summary
Group-IB reports new Tortoiseshell infrastructure across Europe and the Middle East, a reverse SSH tunneler disguised as a Windows Terminal Server SDK API, and a C++ backdoor resembling TWOSTROKE with file, execution and host-information commands.
Key points
- Group-IB attributes newly identified infrastructure and malware to Nimbus Manticore, which it links to Tortoiseshell.
- The reported infrastructure spans Europe and the Middle East and may indicate expanded targeting.
- A reverse SSH tunneling tool masquerades as the Windows Terminal Server SDK API and connects to operator infrastructure.
- A C++ backdoor resembling TWOSTROKE can collect system information, manipulate files, load DLLs and maintain persistence.
- The backdoor can receive commands to transfer files, execute binaries or DLLs, gather host information, list directories and delete files.
- Earlier reporting described NightLedger, BridgeHead and ArcBridge as tools used to maintain access to compromised hosts.
Article Details
- Event Type
- Discovery of new infrastructure and previously undocumented malware associated with cyber espionage activity.
- Impact
- The reported reverse SSH tunneler and TWOSTROKE-like backdoor support remote access, system and file operations, and persistence. The activity is associated with targeting across the Middle East and Europe; the article does not report specific victim organizations or confirmed data loss.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 172[.]86[.]98[.]113 | Operator infrastructure contacted by the reverse SSH tunneling tool. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe backdoor can upload files; the article describes it communicating with command-and-control servers.T1071.001 · Web ProtocolsThe backdoor uses HTTPS to communicate with its command-and-control servers.T1082 · System Information DiscoveryThe backdoor can gather host and system information.T1083 · File and Directory DiscoveryThe backdoor can list directories.T1105 · Ingress Tool TransferThe backdoor can download files.T1572 · Protocol TunnelingThe tool establishes a reverse SSH tunnel to operator infrastructure.
People
Threat Actors
Charming KittenThreat actor cluster identified in the article as the cluster of which Tortoiseshell is a part; also referred to as Eclipsed Wasp.Imperial KittenNamed in the article as an alias of Tortoiseshell.Mirage KittenNamed in the article as an alias of Nimbus Manticore.Nimbus ManticoreIranian state-sponsored cyber espionage group linked to the IRGC; the article reports its use of malware and tunneling tools.Screening SerpensNamed in the article as an alias of Nimbus Manticore.TortoiseshellThreat group whose infrastructure the article says Group-IB uncovered; the article says it is also known as Imperial Kitten and Unyielding Wasp.UNC1549Named in the article as an alias of Nimbus Manticore.
Malware
Industries
AerospaceTortoiseshell is known to be active since at least July 2018, mainly targeting defense, aerospace, IT service providers, and military organizations in the Middle East and the U.S.DefenseTortoiseshell is known to be active since at least July 2018, mainly targeting defense, aerospace, IT service providers, and military organizations in the Middle East and the U.S.MilitaryTortoiseshell is known to be active since at least July 2018, mainly targeting defense, aerospace, IT service providers, and military organizations in the Middle East and the U.S.