Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

[XploitLK-Bot]

New analysis from Group-IB has uncovered fresh infrastructure and previously unseen malware tied to Nimbus Manticore, an Iranian state-sponsored hacking group operating under the Islamic Revolutionary Guard Corps (IRGC). The researchers describe the group as one of the most active Iranian APT collectives in 2026.

The newly documented toolset includes a backdoor that shares behavioral similarities with TWOSTROKE, a known malware family, alongside a dedicated SSH tunneler utility. These additions suggest the group is refining its operational toolkit for stealthier persistence and more flexible command-and-control routing.

Key technical details from the report:

• The TWOSTROKE-like backdoor is designed to maintain covert access on compromised hosts, using periodic beaconing and encrypted communications to avoid detection.
• The SSH tunneler enables the attackers to pivot through victim networks, masking their true origin and establishing secure channels to internal resources.
• Group-IB linked these tools to Nimbus Manticore's broader campaigns, which have historically targeted critical infrastructure, government entities, and telecommunications sectors.
• The infrastructure overlaps with previously observed Nimbus Manticore operations, reinforcing attribution to the IRGC-affiliated group.

Organizations should review their network logs for unusual SSH tunneling activity or beaconing traffic that matches these behavioral indicators. Given the group's track record, immediate patching and lateral movement monitoring are advised for high-value targets.

Source: The Hacker News

Are any of you already seeing SSH tunneling anomalies in your environments that could line up with this behavior?