Iran-Linked Hackers Expand Attacks With New Backdoor and Reverse SSH Tunnels

Iran-linked hackers have expanded an espionage effort with a Windows backdoor and reverse SSH tunnelling utility. The activity is tied to Tortoiseshell, also tracked as Mirage Kitten, UNC1549 and Nimbus Manticore.

The campaign gives operators more ways to retain access after breaking into a network. The tunnelling tool can route traffic from an attacker-controlled server into a victim environment, while the backdoor can run commands, move files and collect details about an infected computer.

Group-IB analysts identified additional malware and infrastructure after enriching published indicators and conducting threat-hunting work.

Their findings suggest that Tortoiseshell is widening its operational footprint across Middle Eastern and European targets.

The group has been active since at least 2018 and has historically focused on defence, aerospace, IT service providers and military organisations.

Its documented entry methods include supply-chain compromise, compromised websites and fake recruitment portals, making user vigilance and layered security important.

Group-IB said in a report shared with Cyber Security News (CSN). The research connects the components to a wider Iranian-linked activity set and underlines the risk to organisations handling strategic or government-adjacent information.

It raises risks for regional defenders facing persistent espionage operations. High-value sectors remain especially exposed.

Iran-Linked Hackers Expand Attacks

One recovered component poses as a normal Windows library named wtsapi32.dll, a file associated with Terminal Server functions. It passes legitimate functions through to avoid suspicion, while quietly launching a reverse SSH connection over port 443 to an operator server.

This is important because the connection begins inside the victim network. Once active, traffic sent to a specified port on the remote server can be channelled back into the compromised environment, helping an intruder reach internal systems without opening an obvious inbound route.

Reverse tunnels have become a recurring way to preserve access after a breach. Readers can compare this approach with reverse tunnel attack concerns, where outbound connections similarly created a path that bypassed expected network boundaries.

The second sample is a C++ implant resembling the TWOSTROKE backdoor reported previously. It also masquerades as wtsapi32.dll and appears designed for DLL search-order hijacking, a method that makes a trusted program load an attacker-controlled library instead of the genuine one.

The backdoor hides key text until runtime, creates a unique identifier from the device hostname, and communicates with hardcoded control servers using HTTPS.

It can receive instructions to upload or steal files, launch programs or shell commands, load a DLL in memory, download files, and list folders.

That reliance on trusted Windows loading behaviour mirrors the technique described in malware abusing DLL search order. For defenders, an unfamiliar wtsapi32.dll beside an application deserves investigation rather than being assumed legitimate.

Infrastructure points to wider reach

Group-IB linked more infrastructure to the operation by pivoting from a known control domain. It found domains and subdomains patterned around country labels, with nodes associated with the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia and Japan.

The researchers cautioned that infrastructure alone cannot prove its final use, since no matching samples were identified for every node.

Still, the geographic naming pattern, coupled with servers retained after one related domain was suspended, indicates preparation that defenders should not ignore.

The findings reinforce a lesson from APT attacks on RDP servers: persistent groups often maintain more than one route into a network. A secondary tunnel or backdoor can keep an operation alive when the main access method is detected and removed.

Organisations in affected sectors should continuously hunt for unusual DLL side-loading, unknown outbound SSH activity and repetitive HTTPS beaconing.

They should also use endpoint detection tools and focused detection rules, review connections to known infrastructure, and share confirmed sightings with trusted security partners.

Network teams should pay attention to SSH launched from unexpected Windows processes and connections using port 443 that do not behave like ordinary web traffic.

Monitoring these signs alongside SSH-based backdoor warning signs can shorten the time between an intrusion and containment.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	wtsapi32.dll	Name used by both identified malicious DLL samples to masquerade as a legitimate Windows library
MD5 hash	07dd28b748656e9e1a870c538d6df68c	Reverse SSH tunnelling tool
SHA-1 hash	e39bb97415978fa3484298735bd020662a51f3ab	Reverse SSH tunnelling tool
SHA-256 hash	d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b	Reverse SSH tunnelling tool
MD5 hash	db58adc4a6c192520ed509b20a928279	TWOSTROKE backdoor
SHA-1 hash	c0dba95939f7fc1a55b7aa6c132a204f073a981d	TWOSTROKE backdoor
SHA-256 hash	597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437	TWOSTROKE backdoor
IP address	172[.]86[.]98[.]113	Reverse SSH tunnel server
IP address	185[.]66[.]68[.]213	Reported Tortoiseshell-linked infrastructure
IP address	185[.]253[.]116[.]71	Reported Tortoiseshell-linked infrastructure
IP address	185[.]253[.]116[.]242	Reported Tortoiseshell-linked infrastructure
IP address	185[.]253[.]118[.]246	Reported Tortoiseshell-linked infrastructure
IP address	94[.]126[.]227[.]20	Reported Tortoiseshell-linked infrastructure
IP address	89[.]44[.]80[.]42	uae7 node associated with locat[.]sbs
IP address	91[.]193[.]16[.]187	Reported Tortoiseshell-linked infrastructure
IP address	89[.]44[.]80[.]234	uae2 node associated with locat[.]sbs
IP address	89[.]44[.]80[.]6	uae5 node associated with locat[.]sbs
IP address	94[.]126[.]227[.]11	Reported Tortoiseshell-linked infrastructure
IP address	89[.]44[.]80[.]86	Reported Tortoiseshell-linked infrastructure
IP address	185[.]253[.]116[.]99	uae3 node associated with locat[.]sbs
IP address	185[.]253[.]116[.]81	IP linked to the known aecert[.]org control domain
IP address	89[.]44[.]80[.]168	uae1 node associated with locat[.]sbs
IP address	95[.]174[.]68[.]199	uae4 node associated with locat[.]sbs
IP address	185[.]253[.]116[.]166	uae6 node associated with locat[.]sbs
Domain	neexportfolio[.]com	Hardcoded TWOSTROKE command-and-control server
Domain	neexportfolio[.]azurewebsites[.]net	Hardcoded TWOSTROKE command-and-control server
Domain	neexportfolio[.]eastus[.]cloudapp[.]azure[.]com	Hardcoded TWOSTROKE command-and-control server
Domain	aecert[.]org	Known Tortoiseshell control domain used for infrastructure pivoting
Domain	locat[.]sbs	Related infrastructure domain with country-themed subdomains
Domain	tiktok-u[.]sbs	Related infrastructure domain later suspended by its registrar

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC