Nimbus Manticore Deploys Reverse SSH Tunneler and TWOSTROKE-Overlapping C++ Backdoor on 172.86.98.113

The artifacts expand Tortoiseshell-linked operations with an SSH utility binding to port 443 and a backdoor supporting file upload, DLL execution, directory listing, and host enumeration via three hardcoded HTTPS C2s. Both binaries mimic Windows terminal server DLLs, indicating deliberate masquerading rather than generic loaders. Evidence includes binary overlap in command dispatch threads and infrastructure spanning Middle East and European ranges previously unlinked to the cluster.

Technical indicators align with Kaspersky's NightLedger and BridgeHead/ArcBridge reporting from the same actor cluster, yet independent code reuse analysis shows the new backdoor reimplements TWOSTROKE's worker thread model without direct binary copying. Official IRGC attribution rests on infrastructure history and targeting patterns; no public packet captures or exploit chains independently confirm state tasking. Procurement records and prior Dream Job lures remain the strongest continuity signals.

Continued tool evolution suggests Nimbus Manticore is prioritizing stealthy access maintenance over novel initial access vectors. Expect incremental additions to the tunneling suite and possible reuse of the same European IP ranges in follow-on campaigns within 120 days.