Nimbus Manticore expands toolset with TWOSTROKE-like backdoor and SSH tunneler

Group-IB has uncovered new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps. The findings build on recent research from Kaspersky that detailed the group’s use of a new Windows backdoor called NightLedger and two custom WebSocket tunnelers.

The newly discovered artifacts include a reverse SSH tunneling tool that masquerades as the Windows Terminal Server SDK API, and a C++ backdoor that shares similarities with the TWOSTROKE implant. The backdoor mimics the wtsapi32.dll library and uses one of three hard-coded command-and-control servers to establish HTTPS connections and execute commands.

Group-IB said the expanded infrastructure suggests a broader targeting profile, focusing on Middle Eastern and European countries. The continued development of tools demonstrates a threat actor steadily evolving its toolset to maintain access across a growing number of targets.