Tortoiseshell expands malware toolset with new backdoor and SSH tunnel

Group-IB has identified new malware and infrastructure linked to the Iranian-linked threat actor Tortoiseshell, also tracked as Mirage Kitten. The group has been active since at least 2018, primarily targeting defence, aerospace, IT service providers and military organisations in the Middle East and US.

The newly discovered samples include a reverse SSH tunneling utility disguised as wtsapi32.dll, which uses Windows’ OpenSSH client to create a reverse tunnel from the command-and-control server into the compromised network. A second sample is a C++ backdoor with similarities to the TWOSTROKE malware, supporting file and shell command execution, in-memory DLL execution, file transfer, directory listing and file deletion.

Group-IB also identified two domains, locat[.]sbs and tiktok-u[.]sbs, with subdomains using country identifiers including UAE, Saudi Arabia, the UK, Belgium, Canada, Australia and Japan, suggesting a potentially expanded targeting profile across Europe and the Middle East. The company recommends persistent threat hunting and monitoring for unusual wtsapi32.dll side-loading and outbound traffic to known Tortoiseshell infrastructure.