TWOSTROKE-like backdoor

Nimbus Manticore Expands Toolset with Previously Undocumented Malware and SSH Tunneler

Researchers from Group-IB have identified additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps. The new strain features capabilities resembling the TWOSTROKE backdoor and an SSH tunneler, indicating enhanced remote access and persistence mechanisms for the threat actor.