As cited
Copy frozen at (site build).
threat intel
Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
Researchers identified new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored group affiliated with the Islamic Revolutionary Guard Corps. The group deployed a TWOSTROKE-like backdoor and SSH tunneler as part of its expanding toolset. Group-IB characterizes Nimbus Manticore as one of the most active Iranian advanced persistent threat (APT) groups in 2026.
Why it matters: Organizations in the Middle East, energy, telecommunications, and government sectors face ongoing reconnaissance and compromise risks from this active Iranian state-sponsored group and should monitor for the newly documented backdoor and tunneling indicators of compromise (IOCs).
- Source published
- First seen by Cybersecurity Tracker