Nimbus Manticore Expands Toolset with Previously Undocumented Malware and SSH Tunneler

According to a recent analysis published by Group-IB, Nimbus Manticore -- an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC) -- has expanded its toolset with previously undocumented malware. The cyber espionage actor, assessed as among the most active Iranian APT groups in 2026, was found to have developed new capabilities including a backdoor with similarities to the TWOSTROKE malware and an SSH tunneler. These additions suggest improved remote access and persistence mechanisms for the group. Group-IB's research identified additional infrastructure linked to Nimbus Manticore's activities. The report notes that the group targets organizations globally, with activities aligned with typical Iranian APT espionage objectives. The discovery of the new malware strain highlights the evolving capabilities of Iranian state-sponsored threat actors. No specific software vulnerabilities or patches were identified in connection with the new malware; the focus is on the group's developing custom tooling for espionage purposes. Organizations are advised to monitor for indicators of compromise associated with Nimbus Manticore activity and apply general security hardening measures.