Listen to this Post
A Quiet Threat Is Becoming More Sophisticated
Cyber-espionage rarely announces itself with noise. The most dangerous campaigns often grow quietly, adding new tools, infrastructure and access techniques while defenders are still studying the previous generation of malware. That is exactly what the latest research into the Iranian-linked threat actor known as Tortoiseshell appears to reveal.
On August 26, 2026, Group-IB published new findings showing that the group has expanded its toolkit with previously undocumented malware, including a Windows backdoor and a reverse SSH tunneling utility disguised as a legitimate Windows DLL. The research also uncovered infrastructure containing regional identifiers associated with countries across the Middle East, Europe and beyond.
The development matters because Tortoiseshell is not a new actor experimenting with basic malware. The group has been active since at least 2018 and has repeatedly been associated with cyber-espionage operations involving defense, aerospace, military and technology-related organizations.
Kaspersky tracks the same broader threat cluster as Mirage Kitten, also associated with names including UNC1549, Smoke Sandstorm and Nimbus Manticore. Its July 2026 research documented another evolving malware ecosystem involving the NightLedger backdoor and the ArcBridge and BridgeHead tunneling tools.
What makes the latest discovery particularly concerning is not simply the existence of another backdoor. It is the combination of DLL side-loading, legitimate Windows components, encrypted or HTTPS-based communications, reverse tunneling and persistent command execution capabilities.
That combination gives an attacker something far more valuable than a simple foothold: a pathway deeper into an organization’s internal network.
Group-IB Uncovers a New Layer of Tortoiseshell Activity
Group-IB began investigating Tortoiseshell after Kaspersky published research into Mirage Kitten’s newer malware activity. Researchers enriched the publicly available indicators and conducted additional threat hunting, eventually identifying new infrastructure and malware samples that had not previously been publicly documented.
The investigation suggests that the threat actor continues to evolve its operational toolkit rather than relying exclusively on older implants.
This is an important characteristic of mature APT operations. Once defenders learn the fingerprints of one malware family, operators can reduce their exposure by introducing new loaders, new tunneling mechanisms, alternate infrastructure and modified communication patterns.
The latest Tortoiseshell findings fit that model.
The Reverse SSH Tunnel Is the Most Interesting Discovery
One of the most technically significant samples identified by Group-IB is a reverse SSH tunneling utility disguised as wtsapi32.dll, a legitimate Windows component.
The malware reportedly forwards legitimate functions expected from the DLL while abusing the Windows OpenSSH client to establish a connection back toward Tortoiseshell-controlled infrastructure.
The objective is straightforward but powerful.
Instead of simply allowing an attacker to communicate with a compromised machine, the reverse tunnel can create a pathway from attacker-controlled infrastructure into the victim’s internal environment.
That means the compromised system can potentially become a bridge into systems that are not directly exposed to the internet.
Why Reverse Tunneling Creates a Serious Risk
Imagine an organization with an internet-facing workstation that can communicate with internal servers, administrative systems and other protected resources.
If an attacker gains control of that workstation and establishes a reverse tunnel, the attacker may no longer need those internal systems to be directly reachable from the public internet.
The compromised workstation becomes the doorway.
This technique is especially useful during post-compromise operations because it can provide operators with network reachability that would otherwise be unavailable.
Group-IB said the behavior aligns with techniques previously documented by Google Threat Intelligence Group in connection with UNC1549.
That alignment strengthens the broader picture that tunneling is an important part of this threat actor’s operational playbook.
A Familiar Windows DLL Becomes a Hiding Place
The choice of wtsapi32.dll is another important detail.
Legitimate Windows DLLs are trusted components that applications may load during normal operation. When malicious code is placed where Windows or an application expects a legitimate library, defenders may have difficulty distinguishing normal activity from malicious execution.
This is where DLL search-order hijacking becomes dangerous.
The attacker does not necessarily need to replace the legitimate system DLL. Instead, malware can be placed in a location where an application searches before reaching the legitimate Windows directory.
If the malicious library exports the functions the application expects, the process may continue operating while the attacker gains execution.
The Second Sample Is a Full-Fledged Backdoor
Group-IB also discovered a second sample written in C++.
Unlike the tunneling utility, this malware functions as a broader backdoor and reportedly shares similarities with TWOSTROKE, a malware family previously documented by Google Threat Intelligence Group.
It was also disguised as wtsapi32.dll and appeared to be designed for DLL search-order hijacking.
The overlap between the two samples is significant.
One provides covert network tunneling.
The other provides direct control over the infected machine.
Together, they give an operator both endpoint access and a mechanism for moving traffic through the compromised environment.
HTTPS Gives the Backdoor a Familiar Network Profile
The backdoor reportedly communicates with multiple hardcoded command-and-control servers over HTTPS.
That choice is hardly surprising.
HTTPS traffic is ubiquitous across modern enterprise networks, making malicious traffic more difficult to identify using simplistic network monitoring.
A security team cannot simply block HTTPS without disrupting enormous amounts of legitimate business traffic.
Instead, defenders need to examine behavioral signals such as unusual destinations, certificate characteristics, process-to-network relationships, DNS history, connection timing and endpoint anomalies.
Victim Identification Is Built Into the Malware
The malware generates a unique identifier based on the victim’s fully qualified hostname.
That seemingly small detail can be extremely useful to an attacker.
A unique host identifier allows an operator to distinguish individual compromised machines, track them over time and associate commands or collected information with specific systems.
For a targeted espionage campaign, this is far more useful than randomly assigning victims to anonymous sessions.
It effectively turns compromised endpoints into identifiable assets inside the attacker’s command infrastructure.
The Backdoor Offers Extensive Remote Control
According to Group-IB, the C++ backdoor supports multiple capabilities, including file operations, shell command execution, in-memory DLL execution, file transfer, directory listing and file deletion.
These capabilities transform the implant from a simple beacon into a flexible post-exploitation platform.
Shell execution can allow operators to interact with the underlying system.
File transfer can support collection or deployment of additional tools.
Directory enumeration can help attackers understand the victim environment.
File deletion can assist cleanup.
In-memory DLL execution can reduce the need to write additional payloads to disk.
In-Memory Execution Raises the Detection Challenge
Memory-based execution is particularly important for defenders.
Traditional endpoint security controls often place significant emphasis on files written to disk. Malware that minimizes its disk footprint can make some traditional detection approaches less effective.
This does not make an attack invisible.
Memory analysis, behavioral detection, process telemetry and endpoint detection and response systems can still expose suspicious activity.
However, defenders increasingly need to move beyond the question of “Which malicious file was created?”
The more important question becomes:
“What is this process doing that a legitimate process should not be doing?”
The Infrastructure Tells Another Story
The malware samples are only half of the discovery.
Group-IB also identified infrastructure connected to a previously known Tortoiseshell command-and-control domain.
Two domains, locat[.]sbs and tiktok-u[.]sbs, resolved to related servers and contained subdomains using identifiers associated with the UAE, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia and Japan.
That does not automatically prove that organizations in every one of those countries were attacked.
This distinction is critical.
Infrastructure can be prepared for future operations, used for testing, repurposed across campaigns or simply contain naming conventions that do not directly correspond to victim locations.
Group-IB itself cautioned that the actual use of these regional subdomains remained unclear because researchers had not identified associated malware samples.
Europe Could Become Increasingly Relevant
Nevertheless, the infrastructure deserves attention.
The appearance of regional identifiers associated with European countries suggests that defenders should not assume this activity is restricted to the Middle East.
The broader Mirage Kitten ecosystem has historically focused heavily on Middle Eastern and African targets. Kaspersky’s July research identified victims and activity spanning several countries and sectors, including aerospace, aviation, telecommunications, government and financial organizations.
The newly identified infrastructure could therefore represent preparation for a broader campaign—or simply operational infrastructure whose ultimate purpose has not yet been established.
Either way, organizations in Europe and the Middle East should treat the indicators as useful hunting leads rather than waiting for confirmed victimology.
Infrastructure Survived Domain Suspension
Another intriguing detail is what happened after tiktok-u[.]sbs was suspended by its registrar.
According to Group-IB, the servers remained in use, while historical DNS information showed that subdomains associated with the suspended domain had previously resolved to the same infrastructure connected with locat[.]sbs.
This demonstrates why domain-based blocking alone is often insufficient.
If the underlying servers remain operational, attackers can simply redirect another domain toward the same infrastructure.
For defenders, historical DNS and passive DNS analysis can therefore provide much more intelligence than examining current domain resolution alone.
The Bigger Picture: Tortoiseshell Is Building a Modular Arsenal
The most important takeaway is that this is not merely a story about a new DLL.
It is a story about modular cyber-espionage.
A mature threat actor can use different components for different stages of an operation.
One tool can establish access.
Another can execute commands.
Another can tunnel traffic.
Another can move files.
Another can collect intelligence.
This modular approach allows attackers to replace individual components without rebuilding their entire operational infrastructure.
Tunneling Has Become a Recurring Theme
Kaspersky’s July research provides additional context.
Its analysis of Mirage Kitten described NightLedger as a Windows backdoor and identified ArcBridge and BridgeHead as custom tunneling tools designed to provide covert network access.
Kaspersky also noted that Mirage Kitten has previously used tunneling utilities and has continued developing this capability.
That makes the tunneling behavior discovered by Group-IB particularly significant.
It suggests that network access through compromised hosts is not an accidental side effect.
It may be a recurring operational requirement.
Why Defense and Aerospace Organizations Should Pay Attention
Defense and aerospace organizations are particularly attractive targets because their networks can contain sensitive technical information, engineering documentation, procurement data, employee information and communications involving strategic projects.
An attacker does not necessarily need to steal everything.
A single compromised engineering workstation can provide intelligence about organizational structure, projects, suppliers and internal systems.
Once attackers understand the environment, they can determine which machines are valuable and which systems provide additional access.
This is why lateral movement can be more damaging than the original compromise.
The Same Risk Applies to IT Service Providers
IT service providers are another high-value target.
An attacker compromising a technology provider may potentially gain access to multiple customer environments depending on the provider’s architecture and privileges.
This creates a multiplier effect.
Instead of compromising one organization at a time, an attacker may attempt to exploit trusted relationships between technology providers and their customers.
For that reason, service providers should treat privileged access pathways as critical assets and monitor them with the same seriousness as internet-facing infrastructure.
Deep Analysis: How Defenders Should Hunt for This Activity
Start With wtsapi32.dll
Security teams should search for unexpected copies of wtsapi32.dll outside legitimate Windows system directories.
A simple Windows PowerShell hunting command can help identify suspicious copies:
Get-ChildItem C:\ -Filter wtsapi32.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime
The presence of a second copy does not automatically prove compromise.
However, an unexpected wtsapi32.dll located beside an executable that normally loads it deserves investigation.
Examine DLL Load Relationships
Security teams should investigate which processes load unusual instances of wtsapi32.dll.
Useful telemetry includes:
Process creation
ImageLoad events
DLL load paths
Parent-child process relationships
Command-line arguments
Network connections
DNS queries
The critical question is whether a legitimate application unexpectedly loads a DLL from a user-writable or non-standard directory.
Search for OpenSSH Abuse
Because the reverse tunneling utility reportedly uses the Windows OpenSSH client, defenders should investigate unusual SSH activity originating from Windows endpoints.
For example:
Get-Process ssh, sshd -ErrorAction SilentlyContinue
Security teams can also inspect Windows event telemetry and process command lines for unexpected ssh.exe execution.
The presence of OpenSSH itself is not suspicious.
The combination of unexpected SSH execution + unusual destination + suspicious parent process + abnormal DLL loading is much more meaningful.
Hunt for Suspicious Outbound SSH
Network defenders should examine outbound TCP connections commonly associated with SSH, especially when the originating workstation does not normally operate as an SSH client.
Example defensive network query logic could look like:
source_os = Windows AND destination_port = 22 AND process = ssh.exe AND destination NOT IN approved_ssh_destinations
Organizations should adapt this logic to their own environment.
Blocking all outbound SSH may be impractical, but restricting unauthorized SSH destinations can substantially reduce an attacker’s options.
Investigate HTTPS From Unexpected Processes
The backdoor reportedly communicates over HTTPS.
Defenders should therefore correlate network traffic with the process responsible for generating it.
Look for:
Unexpected process -> HTTPS connection Unexpected DLL -> network-enabled process Rare destination -> repeated beaconing New domain -> periodic outbound connections Unknown process -> multiple C2 destinations
Behavioral correlation is significantly stronger than relying on domain reputation alone.
Monitor DLL Search-Order Hijacking
Organizations should prioritize monitoring for suspicious DLL side-loading.
Potential warning signs include:
Executable in unusual directory
+
Unexpected DLL beside executable
+
Legitimate DLL export forwarding
+
Unsigned or newly created DLL
+
Network connection shortly after DLL load
This combination should trigger investigation.
Hunt Through DNS History
The infrastructure findings also highlight the importance of historical DNS.
Do not only ask:
Does this domain resolve today?
Ask:
“What IP addresses has this domain resolved to during the last several months?”
Historical DNS can expose relationships between apparently unrelated domains and help reveal infrastructure reuse.
Search for Regional Subdomains
Organizations should also review DNS telemetry for unusual subdomains containing geographic or country identifiers.
Examples from the reported infrastructure include identifiers associated with:
UAE
Saudi Arabia
UK
Belgium
Canada
Australia
Japan
These strings should not be treated as standalone indicators of compromise.
Instead, they can become pivots for threat hunting when combined with suspicious DNS activity, endpoint telemetry and known infrastructure.
Investigate Hardcoded C2 Relationships
For malware analysis teams, hardcoded C2 servers provide another valuable pivot.
Static analysis can identify:
strings suspicious.dll | grep -Ei https?://|\.com|\.net|\.org|\.sbs
On Linux-based analysis systems, defenders can also use:
strings suspicious.dll | grep -Ei ssh|https|wtsapi32|hostname|cmd|powershell
These commands are intended for malware-analysis environments and should not be executed against unknown files on production systems.
Examine PE Metadata
Analysts should inspect suspicious DLLs using tools such as:
file suspicious.dll sha256sum suspicious.dll
And, in a controlled malware-analysis environment:
objdump -x suspicious.dll
The objective is to determine architecture, exported functions, timestamps, linked libraries and other characteristics that can connect samples to previously identified malware.
Check File Hashes Before Execution
A basic but important rule remains valid:
sha256sum suspicious.dll
Calculate the hash before executing or detonating a suspicious sample.
The resulting hash can then be compared against internal intelligence, EDR records and trusted threat-intelligence sources.
Do Not Trust the Filename
Perhaps the most important practical lesson is that filenames mean very little.
A malicious file named wtsapi32.dll is not legitimate simply because the name is legitimate.
Security teams should validate:
File path
Digital signature
Hash
PE metadata
Loaded-by process
Parent process
Network behavior
Creation time
Modification time
Identity must be established through behavior and provenance, not naming.
What Undercode Say:
1. The Real Danger Is the Combination
The reverse SSH tool and the backdoor are dangerous individually, but their combination is much more concerning.
2. Tunneling Changes the Battlefield
A compromised endpoint can become a gateway into networks that attackers could not otherwise reach.
3. Legitimate Tools Are Becoming Attack Infrastructure
Using OpenSSH gives attackers access to software that organizations already expect to see.
4. DLL Side-Loading Remains Effective
Despite years of awareness, DLL search-order hijacking continues to provide attackers with a useful execution mechanism.
5. Trusted Windows Components Can Become Weapons
A familiar DLL name can make malicious activity appear less suspicious to inexperienced analysts.
6. File Names Are Weak Indicators
Security controls should focus on paths, signatures, hashes and behavior.
7. HTTPS Is Not Automatically Safe
Encrypted traffic protects confidentiality, but it does not prove that the destination is legitimate.
8. C2 Infrastructure Is Becoming More Disposable
Attackers can move between domains and servers when defenders begin blocking known indicators.
9. Historical DNS Is Extremely Valuable
Past DNS relationships can expose infrastructure that current DNS queries no longer reveal.
- Domain Suspension Does Not End an Operation
The infrastructure can survive even when a specific domain disappears.
11. APT Groups Think in Infrastructure
Malware is only one component of an espionage operation.
12. The Infrastructure Can Reveal Intent
Regional naming patterns may provide clues about future targeting, although they cannot independently prove victimization.
- Europe Should Not Assume It Is Outside the Risk Zone
The newly identified infrastructure contains European regional references.
14. The Middle East Remains Highly Relevant
The wider Mirage Kitten ecosystem has repeatedly focused on organizations in the region.
15. Aerospace Remains a Strategic Target
Engineering and aviation information can have enormous intelligence value.
16. Defense Organizations Need Deeper Telemetry
Basic antivirus detection is not enough against modular espionage toolkits.
17. IT Providers Are Especially Sensitive
Compromise of a trusted provider can create opportunities for downstream attacks.
18. Remote Access Tools Need Context
The presence of SSH is not inherently malicious.
19. Abnormal SSH Behavior Is Different
Unexpected SSH activity from ordinary Windows workstations deserves investigation.
20. Process-to-Network Correlation Is Critical
Knowing which process generated a connection can reveal attacks that domain reputation misses.
21. Endpoint Telemetry Is Becoming More Important
Modern APT detection increasingly depends on behavioral visibility.
22. Memory Analysis Matters
In-memory execution can reduce traditional file-based detection opportunities.
23. Attackers Want Persistence Without Attention
A quiet backdoor is often more valuable than destructive malware.
24. Espionage Rewards Patience
APT operators may spend weeks or months learning an environment.
- Lateral Movement Can Be the Main Objective
The first compromised system may only be an entry point.
26. Reverse Tunnels Facilitate Lateral Operations
They can provide operators with access paths through compromised machines.
27. Network Segmentation Still Matters
Segmentation can limit the damage even after an endpoint is compromised.
28. Egress Controls Deserve More Attention
Organizations often focus heavily on inbound traffic while underestimating outbound connections.
29. SSH Egress Should Be Controlled
Not every Windows workstation needs unrestricted outbound SSH access.
- DNS Monitoring Can Reveal More Than Domain Blocking
Relationships between domains and IP addresses can expose attacker infrastructure.
31. Threat Hunting Should Be Continuous
APT infrastructure changes faster than static blocklists.
32. Indicators Should Become Hunting Hypotheses
A suspicious domain should lead analysts toward related infrastructure and behaviors.
33. Security Teams Should Track DLL Loading
Unexpected DLL locations can expose side-loading attempts.
34. Multiple Hardcoded C2 Servers Are Significant
Redundant C2 infrastructure gives attackers resilience when individual servers become unavailable.
35. Attackers Are Designing for Failure
The ability to change infrastructure is part of modern operational security.
36. Attribution Should Remain Careful
Similarities between malware and infrastructure strengthen hypotheses but do not automatically prove every operational detail.
37.
The combination of backdoor and tunneling capabilities indicates continued investment in operational flexibility.
38. Defenders Should Expect More Tooling
Once a threat actor adopts a successful technique, additional variants often follow.
39. The Best Defense Is Layered
Endpoint, identity, DNS, network and memory telemetry should reinforce one another.
40. The Biggest Lesson Is Simple
If a legitimate Windows DLL suddenly becomes the doorway for an SSH tunnel and a remote-control implant, defenders need to investigate the behavior—not just the filename.
✅ Group-IB Published New Tortoiseshell Research
Confirmed. Group-IB published its Tortoiseshell research on August 26, 2026, describing newly identified malware samples and operational infrastructure.
The publication states that the investigation followed
✅ Mirage Kitten Is Associated With UNC1549
Confirmed.
Kaspersky also describes activity involving aerospace, aviation, defense and telecommunications organizations across the Middle East and Africa.
✅ New Backdoor and Tunneling Capabilities Were Reported
Confirmed. Group-IB reports a reverse SSH tunneling utility and a separate C++ backdoor disguised as wtsapi32.dll.
The backdoor reportedly supports command execution, file operations, file transfer, directory listing and in-memory DLL execution.
⚠️ Wider European Targeting Is Not Yet Proven
Partially confirmed. Group-IB identified infrastructure containing regional identifiers associated with several European and Middle Eastern countries.
However, the researchers explicitly noted that the actual use of those regional subdomains remained unclear because associated malware samples had not been identified.
Therefore, the infrastructure suggests potential expansion, but it should not be presented as definitive evidence that organizations in every named country were targeted.
Prediction
(+1) Tortoiseshell Will Continue Expanding Its Modular Toolset
The most likely development is continued evolution of Tortoiseshell’s malware ecosystem.
The group has demonstrated an apparent interest in combining backdoors with tunneling capabilities, and Kaspersky’s recent research independently documents Mirage Kitten’s use of multiple tunneling tools alongside a dedicated Windows backdoor.
That suggests future campaigns may rely less on one monolithic malware family and more on specialized components that can be swapped as defenders discover them.
Organizations should therefore prepare for new loaders, alternate DLLs, replacement C2 domains and additional tunneling mechanisms, rather than assuming that blocking the currently known indicators will permanently stop the activity.
The Next Battle Will Be About Visibility
The strongest defense against this type of campaign is not a single antivirus signature.
It is visibility.
Organizations need to know which DLLs are being loaded, which processes are creating network connections, which Windows machines are unexpectedly launching SSH, which destinations are receiving periodic HTTPS traffic and which endpoints are communicating with newly registered or historically suspicious infrastructure.
Tortoiseshell’s latest activity is a reminder that sophisticated espionage campaigns do not always require spectacular zero-days.
Sometimes, the most effective attack is built from legitimate components, carefully disguised malware, persistent infrastructure and a quiet tunnel into the network.
And once that tunnel exists, the attacker may already be much deeper inside the organization than the first infected computer suggests.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
