Iranian APT 'Nimbus Manticore' Deploys New TWOSTROKE-Like Backdoor and SSH Tunneling Infrastructure

Executive Summary

Cybersecurity researchers have uncovered a significant expansion in the operational capabilities of the Iranian state-sponsored threat actor known as Nimbus Manticore. Affiliated with the Islamic Revolutionary Guard Corps (IRGC), this group has been observed deploying a previously undocumented backdoor that shares functional similarities with the known TWOSTROKE malware. This development marks a shift toward more resilient, stealthy persistence mechanisms within compromised networks.

Threat Analysis

Nimbus Manticore has historically focused on espionage and intelligence gathering against regional adversaries and Western interests. The recent discovery of their new toolset indicates a concerted effort to improve their ability to maintain long-term access to high-value targets. By utilizing custom SSH tunneling capabilities, the group can bypass traditional perimeter defenses and exfiltrate sensitive data while maintaining a low profile, effectively evading standard signature-based detection systems.

Technical Details

The newly identified malware functions as a modular backdoor, allowing the operators to execute arbitrary commands, perform file system operations, and exfiltrate data. A key component of this campaign is the integration of a custom SSH tunneling tool that facilitates encrypted communication channels between the compromised host and the attacker-controlled command-and-control (C2) infrastructure. The malware employs advanced obfuscation techniques and mimics legitimate system processes to hide its presence. Furthermore, the use of TWOSTROKE-like code structures suggests a shared development lineage or a collaborative effort between different Iranian-nexus threat clusters to standardize their offensive toolkits.

Attribution Assessment

Based on infrastructure overlaps, targeting patterns, and the specific TTPs (Tactics, Techniques, and Procedures) observed, researchers have attributed this activity to Nimbus Manticore. The group's alignment with the IRGC remains a primary indicator of its strategic objectives, which include supporting Iranian geopolitical interests through cyber espionage and potential disruptive operations. The sophistication of the code and the operational security maintained by the actors suggest a well-resourced, state-backed development cycle.

Implications

The deployment of these tools poses a critical risk to government agencies, defense contractors, and critical infrastructure operators. The ability to establish persistent, encrypted tunnels allows the threat actors to conduct prolonged surveillance and data theft without triggering immediate alerts. This evolution in capability underscores the ongoing challenge of detecting state-sponsored actors who are increasingly leveraging modular, multi-stage intrusion frameworks.

Recommendations

Organizations are advised to implement robust network monitoring to detect anomalous SSH traffic patterns and unauthorized outbound connections. It is critical to enforce strict egress filtering and adopt a zero-trust architecture to limit lateral movement. Security teams should prioritize the deployment of endpoint detection and response (EDR) solutions capable of identifying behavioral anomalies associated with fileless execution and unauthorized process injection. Regular threat hunting exercises focusing on the identified TTPs are essential to mitigate the risk of long-term persistence.