Key Takeaways
- Nimbus Manticore (also tracked as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, UNC1549) is an Iranian state‑sponsored APT linked to the IRGC and closely tied to the Tortoiseshell/Charming Kitten cluster.
- Group‑IB’s 2026 analysis uncovered extensive Tortoiseshell infrastructure spanning Europe and the Middle East, indicating a broadening target set.
- Two newly identified tools were observed: an SSH‑based reverse‑tunneling utility masquerading as the Windows Terminal Server SDK API and a C++ backdoor sharing code similarities with the previously known TWOSTROKE implant.
- The SSH tunnel connects to operator‑controlled infrastructure at 172.86.98.[.]113:443, while the backdoor mimics wtsapi32.dll, uses hard‑coded C2 servers, and can execute a range of commands (file transfer, process execution, system reconnaissance, etc.).
- Complementary Kaspersky research highlighted the group’s use of a Windows backdoor called NightLedger and two custom WebSocket tunnelers (BridgeHead, ArcBridge) aimed at maintaining persistence across Middle Eastern, African, and South Asian targets.
- Collectively, the findings show Nimbus Manticore steadily evolving its toolset, adapting tunneling and backdoor techniques to sustain access across a growing number of victims in diverse regions.
Overview of Nimbus Manticore
Nimbus Manticore is an Iranian cyber‑espionage group that operates under the auspices of the Islamic Revolutionary Guard Corps (IRGC). Security researchers track the actor under numerous aliases—GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549—reflecting its frequent rebranding and tool‑iteration cycles. The group has been active since at least 2018 and is regarded as one of the most prolific Iranian APTs in 2026, consistently launching campaigns that blend social engineering with custom malware to infiltrate high‑value targets.
Affiliations and Naming Conventions
Analysts assess that Nimbus Manticore is closely linked to Tortoiseshell (also known as Imperial Kitten and Unyielding Wasp), which itself belongs to the broader Charming Kitten (Eclipsed Wasp) cluster. Tortoiseshell’s activity dates back to July 2018, with a historical focus on defense, aerospace, IT service providers, and military organizations across the Middle East and the United States. Nimbus Manticore has also revived its own variant of the “Dream Job” campaign, luring victims with fake job‑offer communications to deliver malicious payloads.
Group‑IB Findings on Tortoiseshell Infrastructure
In a recent report, Singapore‑based Group‑IB detailed the discovery of extensive Tortoellshell infrastructure that stretches across Europe and the Middle East. The researchers, Mansour Alhmoud and Mohamed Emam, noted that the uncovered assets potentially signal an expanded targeting profile, incorporating European entities alongside traditional Middle Eastern victims. This infrastructure includes command‑and‑control (C2) servers, redirectors, and staging hosts that support the group’s ongoing espionage operations.
SSH‑Based Tunneling Utility Details
Among the newly uncovered artifacts is a reverse SSH tunneling tool designed to masquerade as the Windows Terminal Server SDK API. Upon execution, the utility establishes an outbound SSH connection to operator‑controlled infrastructure at the IP address 172.86.98.[.]113 on port 443, effectively creating a covert channel that blends with legitimate traffic. By disguising itself as a benign Windows component, the tool evades many network‑based detection mechanisms while providing attackers with reliable, persistent access to compromised hosts.
C++ Backdoor Similar to TWOSTROKE
The second malware family identified by Group‑IB is a C++ backdoor that shares notable code similarities with the previously documented TWOSTROKE implant. This backdoor mimics the legitimate Windows DLL wtsapi32.dll, allowing it to blend into system processes. It contacts one of three hard‑coded C2 servers over HTTPS, awaits instructions, and, upon receiving a response, extracts the command and spawns a worker thread to execute it. Supported capabilities include file upload/download, binary or DLL execution, host information gathering, directory listing, and selective file deletion—providing the operator with a versatile post‑exploitation toolkit.
Kaspersky’s Complementary Findings
Parallel research from Kaspersky highlighted additional tools employed by Nimbus Manticore, namely a novel Windows backdoor dubbed NightLedger and two custom WebSocket tunnelers named BridgeHead and ArcBridge. These utilities are designed to maintain persistent access to compromised systems, particularly in targets across the Middle East, Africa, and South Asia. NightLedger provides stealthy command execution, while BridgeHead and ArcBridge facilitate encrypted communication channels that can bypass conventional firewall rules.
Implications and Evolution of the Threat Actor
The convergence of Group‑IB’s and Kaspersky’s observations paints a picture of a threat actor that is continuously refining its arsenal. By layering SSH‑based tunneling, C++ backdoors reminiscent of TWOSTROKE, and innovative WebSocket utilities, Nimbus Manticore demonstrates an ability to adapt to evolving defensive measures. The expanded geographic focus—now encompassing European entities alongside its traditional Middle Eastern focus—suggests a strategic shift toward broader intelligence gathering. Organizations operating in defense, aerospace, IT services, and related sectors should prioritize monitoring for anomalous SSH outbound connections, suspicious DLL masquerading, and unusual WebSocket traffic, while employing robust endpoint detection and response (EDR) solutions to detect the characteristic behaviors of these tools.