Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel

An Iranian-linked threat actor has expanded its malware toolset with a backdoor and reverse SSH tunneling utility, while newly identified infrastructure points to potential targeting across Europe and the Middle East. Group-IB Threat Intelligence began investigating Tortoiseshell after Kaspersky published research on the group in July, and has now identified additional infrastructure and previously unreported malware samples. In a technical write-up published on August 26, Group-IB said the cyber-espionage group, which it tracks as Tortoiseshell and Kaspersky as Mirage Kitten, has been active since at least 2018 and has primarily targeted defense, aerospace, IT service providers and military organizations in the Middle East and US. Tortoiseshell Adds Backdoor and SSH Tunnel One newly identified sample was a reverse SSH tunneling utility disguised as the Windows Terminal Server API DLL wtsapi32.dll. The malware forward-exported legitimate functions from the DLL while using Windows' OpenSSH client to connect to Tortoiseshell infrastructure. The resulting reverse tunnel could redirect traffic from the command-and-control (C2) server into the compromised network. Group-IB said the behavior aligned with techniques previously documented by Google Threat Intelligence Group (GTIG) for UNC1549. A second sample was a C++ backdoor that Group-IB said showed similarities to the TWOSTROKE malware previously documented by GTIG in late 2025. The malware was also disguised as wtsapi32.dll and appeared designed to be loaded through DLL search-order hijacking. The backdoor established HTTPS communications with multiple hardcoded C2 servers and generated a unique identifier from the victim's fully qualified hostname. It supported file and shell command execution, in-memory DLL execution, file transfer, directory listing and file deletion. Infrastructure Points to Wider Targeting Group-IB also identified infrastructure connected to a previously known Tortoiseshell C2 domain. Two domains, locat[.]sbs and tiktok-u[.]sbs, resolved to related servers and contained subdomains using country or regional identifiers including UAE, Saudi Arabia, the UK, Belgium, Canada, Australia and Japan. The infrastructure could indicate an expanded targeting profile covering Middle Eastern and European countries, although Group-IB stressed that its actual use remained unclear because researchers had not identified related malware samples. Group-IB also noted that the servers remained in use after the tiktok-u[.]sbs domain was suspended by its registrar, with historical DNS data showing that its subdomains had previously resolved to the same servers as those associated with locat[.]sbs. The company recommended persistent threat hunting, monitoring for unusual wtsapi32.dll side-loading and outbound traffic associated with known Tortoiseshell infrastructure.