An Iran-linked threat group is expanding its espionage toolkit with a Windows backdoor and a reverse SSH tunneling utility designed to preserve covert access to compromised networks. The activity is attributed to Tortoiseshell, a cluster also known as Mirage Kitten, UNC1549 and Nimbus Manticore.

Group-IB researchers uncovered the additional malware and command-and-control infrastructure by enriching previously reported indicators and hunting for related systems. The findings point to an operation with potential reach across the Middle East and Europe, although infrastructure naming alone does not prove that every apparent country-specific node was used against a victim.

Malware hides behind a familiar Windows filename

Both recovered components use the name wtsapi32.dll, which normally belongs to a legitimate Windows library associated with Terminal Services. Masquerading under a familiar filename can reduce suspicion during a quick inspection, while the malicious library forwards legitimate functions so the host application continues to work.

One sample establishes a reverse SSH connection over port 443 to an attacker-controlled server. Because the connection starts from inside the victim environment, it may pass through defenses that block unsolicited inbound access. Traffic arriving at a selected port on the remote server can then be carried through the tunnel into internal network resources.

Port 443 is normally associated with HTTPS, making traffic on that port easy to overlook if monitoring relies only on port numbers. Protocol-aware inspection and process telemetry are more useful: defenders should determine whether the connection actually behaves like web traffic and whether the initiating Windows process has a legitimate reason to run SSH.

TWOSTROKE-like backdoor adds hands-on control

The second C++ implant resembles the previously documented TWOSTROKE backdoor. It is built for DLL search-order hijacking, in which a trusted executable loads an attacker’s library from a preferred local path instead of the genuine Windows component.

After execution, the implant derives a unique identifier from the computer’s hostname and communicates with hardcoded control servers over HTTPS. Its command set gives operators broad control: it can upload or exfiltrate files, start programs and shell commands, load a DLL directly in memory, download additional content and enumerate directories.

Using separate tunneling and backdoor capabilities gives the operator resilience. If one channel is detected or blocked, another may keep the intrusion alive. The tunnel can also expose internal services to the attacker without requiring a conspicuous inbound firewall rule.

A long-running espionage focus

Tortoiseshell has operated since at least 2018 and has historically targeted defense, aerospace, military organizations and IT service providers. Reported entry techniques include compromised websites, fake recruitment portals and supply-chain intrusion. Those methods align with an intelligence-gathering mission aimed at organizations holding strategic or government-adjacent information.

Researchers connected infrastructure labeled around the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia and Japan. They also identified servers retained after a related domain was suspended. These patterns suggest preparation and geographic interest, but defenders should avoid treating labels as conclusive victim attribution without matching endpoint or network evidence.

What defenders should hunt for

• Unexpected copies of wtsapi32.dll beside application executables, especially when their signature or hash differs from the Microsoft file.
• SSH sessions initiated by unusual Windows processes or tunneled over port 443.
• HTTPS beaconing to unfamiliar infrastructure at regular intervals.
• Trusted applications loading DLLs from user-writable or nonstandard directories.
• File discovery, command-shell activity and in-memory module loading from processes that normally lack those behaviors.

Organizations in high-value sectors should combine endpoint detection with network analytics and review the indicators published by the researchers in controlled threat-intelligence systems. Known hashes and domains can accelerate triage, but behavioral detection is more durable when attackers replace infrastructure or rebuild samples.

Incident responders who identify one component should assume additional access paths may exist. Containment should include credential rotation, examination of adjacent hosts, persistence hunting and review of outbound traffic before systems return to service. The campaign demonstrates why removing a visible payload is not the same as evicting a persistent espionage operator from the network.