Iran-Linked Hackers Expand Attacks With New Backdoor and Reverse SSH Tunnels

Iran-linked hackers have expanded an espionage effort with a Windows backdoor and reverse SSH tunnelling utility. The activity is tied to Tortoiseshell, also tracked as Mirage Kitten, UNC1549 and Nimbus Manticore.

The campaign gives operators more ways to retain access after breaking into a network. The tunnelling tool can route traffic from an attacker-controlled server into a victim environment, while the backdoor can run commands, move files and collect details about an infected computer.

Group-IB analysts identified additional malware and infrastructure after enriching published indicators and conducting threat-hunting work.

Their findings suggest that Tortoiseshell is widening its operational footprint across Middle Eastern and European targets.

The group has been active since at least 2018 and has historically focused on defence, aerospace, IT service providers and military organisations.

Its documented entry methods include supply-chain compromise, compromised websites and fake recruitment portals, making user vigilance and layered security important.

Group-IB said in a report shared with Cyber Security News (CSN). The research connects the components to a wider Iranian-linked activity set and underlines the risk to organisations handling strategic or government-adjacent information.

It raises risks for regional defenders facing persistent espionage operations. High-value sectors remain especially exposed.

Iran-Linked Hackers Expand Attacks

One recovered component poses as a normal Windows library named wtsapi32.dll, a file associated with Terminal Server functions. It passes legitimate functions through to avoid suspicion, while quietly launching a reverse SSH connection over port 443 to an operator server.

This is important because the connection begins inside the victim network. Once active, traffic sent to a specified port on the remote server can be channelled back into the compromised environment, helping an intruder reach internal systems without opening an obvious inbound route.

Reverse tunnels have become a recurring way to preserve access after a breach. Readers can compare this approach with reverse tunnel attack concerns, where outbound connections similarly created a path that bypassed expected network boundaries.

The second sample is a C++ implant resembling the TWOSTROKE backdoor reported previously. It also masquerades as wtsapi32.dll and appears designed for DLL search-order hijacking, a method that makes a trusted program load an attacker-controlled library instead of the genuine one.

The backdoor hides key text until runtime, creates a unique identifier from the device hostname, and communicates with hardcoded control servers using HTTPS.

It can receive instructions to upload or steal files, launch programs or shell commands, load a DLL in memory, download files, and list folders.

That reliance on trusted Windows loading behaviour mirrors the technique described in malware abusing DLL search order. For defenders, an unfamiliar wtsapi32.dll beside an application deserves investigation rather than being assumed legitimate.

Infrastructure points to wider reach

Group-IB linked more infrastructure to the operation by pivoting from a known control domain. It found domains and subdomains patterned around country labels, with nodes associated with the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia and Japan.

The researchers cautioned that infrastructure alone cannot prove its final use, since no matching samples were identified for every node.

Still, the geographic naming pattern, coupled with servers retained after one related domain was suspended, indicates preparation that defenders should not ignore.

The findings reinforce a lesson from APT attacks on RDP servers: persistent groups often maintain more than one route into a network. A secondary tunnel or backdoor can keep an operation alive when the main access method is detected and removed.

Organisations in affected sectors should continuously hunt for unusual DLL side-loading, unknown outbound SSH activity and repetitive HTTPS beaconing.

They should also use endpoint detection tools and focused detection rules, review connections to known infrastructure, and share confirmed sightings with trusted security partners.

Network teams should pay attention to SSH launched from unexpected Windows processes and connections using port 443 that do not behave like ordinary web traffic.

Monitoring these signs alongside SSH-based backdoor warning signs can shorten the time between an intrusion and containment.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Iran-Linked Hackers Expand Attacks With New Backdoor and Reverse SSH Tunnels appeared first on Cyber Security News.