Researchers have identified new tools used by the Tortoiseshell group, an Iranian-linked operation also tracked as Mirage Kitten, UNC1549, and Nimbus Manticore. The campaign relies on a Windows backdoor and reverse SSH tunnels to maintain long-term access to compromised networks.
Active since at least 2018, the group has a history of targeting organizations in the defense, aerospace, technology, IT services, and military sectors, mainly in the Middle East and the United States. One of the newly discovered tools masquerades as the legitimate wtsapi32.dll file.
The malware retains the expected functions of the Windows library while silently initiating a reverse SSH connection to the attackers’ infrastructure. Communication occurs over port 443, allowing operators to forward traffic from the command-and-control server directly into the victim network without requiring direct inbound connections.
The implant can execute programs and commands, download and exfiltrate files, load DLLs directly into memory, list directories, and collect information about the infected user and computer. The investigation also revealed infrastructure linked to countries including the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia, and Japan.
