Tortoiseshell Expands Toolset With Backdoor, SSH Tunnel

Group-IB Threat Intelligence has uncovered new malware samples and infrastructure tied to Tortoiseshell, an Iranian-linked cyber-espionage group active since at least 2018. The findings, published on August 26, detail a reverse SSH tunneling utility and a C++ backdoor, both disguised as a legitimate Windows DLL. The newly identified domains also suggest the group may be expanding its targeting footprint beyond its traditional focus on the Middle East and the US.

New Malware Samples Detailed

Group-IB's technical write-up, published on August 26, details two previously unreported malware samples. The first is a reverse SSH tunneling utility disguised as the Windows Terminal Server API DLL wtsapi32.dll. The malware forward-exported legitimate functions from the DLL while using Windows' OpenSSH client to connect to Tortoiseshell infrastructure.

The second sample is a C++ backdoor showing similarities to the TWOSTROKE malware previously documented by Google Threat Intelligence Group (GTIG) in late 2025. Like the tunneling utility, this backdoor is also disguised as wtsapi32.dll and appears designed to be loaded through DLL search-order hijacking.

Reverse SSH Tunnel for Network Access

The reverse SSH tunneling utility allows attackers to redirect traffic from the command-and-control (C2) server into the compromised network. Group-IB noted that this behavior aligns with techniques previously documented by GTIG for UNC1549. This gives the group a stealthy method to access internal resources without direct network entry.

Backdoor Capabilities and C2 Communication

The C++ backdoor establishes HTTPS communications with multiple hardcoded C2 servers. It generates a unique identifier from the victim's fully qualified hostname. The backdoor supports file and shell command execution, in-memory DLL execution, file transfer, directory listing, and file deletion.

Infrastructure Points to Wider Targeting

Group-IB also identified infrastructure connected to a previously known Tortoiseshell C2 domain. Two domains, locat[.]sbs and tiktok-u[.]sbs, resolved to related servers and contained subdomains using country or regional identifiers including UAE, Saudi Arabia, the UK, Belgium, Canada, Australia and Japan.

The infrastructure could indicate an expanded targeting profile covering Middle Eastern and European countries, although Group-IB stressed that its actual use remained unclear because researchers had not identified related malware samples.

Servers Remain Active

Group-IB noted that the servers remained in use after the tiktok-u[.]sbs domain was suspended by its registrar. Historical DNS data showed that its subdomains had previously resolved to the same servers as those associated with locat[.]sbs.

Group's History and Focus

Tortoiseshell, tracked by Kaspersky as Mirage Kitten, has been active since at least 2018 and has primarily targeted defense, aerospace, IT service providers and military organizations in the Middle East and the US. Group-IB began investigating the group after Kaspersky published research on it in July.

Why It Matters

The addition of new tools and infrastructure suggests Tortoiseshell is continuing to invest in its capabilities. The reverse SSH tunneling utility could allow the group to maintain a quieter presence inside networks, while the backdoor provides a range of post-exploitation actions. The expanded domain list hints at potential targets in Europe and beyond, though the lack of associated malware samples means researchers cannot yet confirm active campaigns in those regions. Organizations in the group's known sectors—defense, aerospace, IT services, and military—should pay close attention to these developments. Persistent threat hunting, monitoring for unusual wtsapi32.dll side-loading, and outbound traffic associated with known Tortoiseshell infrastructure are recommended mitigation steps.