Researchers have uncovered a significant escalation in spying tactics by APT group Tortoiseshell—also known as Mirage Kitten, UNC1549, or Nimbus Manticore. The threat actor has introduced a new Windows backdoor and reverse SSH tunneling tools to circumvent security defenses and maintain persistent access inside compromised networks. These findings come from an investigation led by Group-IB, who probed enriched threat intelligence and conducted threat-hunting across affected industries.
New Malware Components Revealed
The group now uses a malicious library masquerading as wtsapi32.dll, a legitimate component used in Terminal Server operations. This loader lets standard functions pass through to avoid detection, while secretly establishing a reverse SSH tunnel over port 443. That tunnel creates a link from a remote attacker-controlled server back into the victim’s internal systems, giving operators stealthy inbound access despite firewalls or network segmentation.
Also discovered is a C++ backdoor that mimics aspects of the known TWOSTROKE implant. It uses DLL search-order hijacking to substitute the real wtsapi32.dll with its malicious version. Once active, it can conduct file transfers, run arbitrary commands or executable code, load additional DLLs in memory, and explore directory structures. The backdoor hides critical strings until execution, generates a unique identifier based on host machine name, and communicates with hard-coded control servers via HTTPS.
Geographic Footprint & Attack Reach
Group-IB linked various domains and servers to the campaign—many using naming schemes tied to specific countries. Nodes were found labeled for the UAE, Saudi Arabia, UK, Belgium, Canada, Australia, and Japan. Although not every node yet has a matched malware sample, the pattern suggests that Tortoiseshell is preparing or maintaining access across multiple regions. Some infrastructure is still operational even after related domains were taken down.
The group has been active since at least 2018, targeting sectors like defence, aerospace, IT service providers and military organisations. Their prior methods include supply-chain compromise, poisoned websites, and fake recruitment portals. These entry points underscore why user awareness and layered defenses are crucial.
Indicators & Defensive Strategies
Key indicators of compromise include:
- Anomalous
wtsapi32.dlllibraries placed beside trusted applications. - Outbound reverse SSH connections initiated from unexpected processes, particularly over port 443.
- HTTPS beaconing and unusual control traffic invisible to standard filtering.
- Commands that move files, list directories, load DLLs in memory, or execute shell instructions.
- Control domains like
neexportfolio.com,locat[.]sbs, andaecert[.]org, plus specific IP addresses tied to compromised infrastructure.
To counter these threats, organisations should adopt continuous monitoring with endpoint detection tools, implement strong detection rules, audit domain and IP connections, and share threat intelligence with trusted partners. Particular attention is required for any SSH processes originating from Windows systems that aren’t typically associated with SSH activity.
Tortoiseshell’s enhanced toolkit marks a shift toward more advanced stealth and control mechanisms—tools designed not just for initial intrusion, but for maintaining access. With regional names popping up in infrastructure and control domains appearing nearly everywhere, this campaign appears broadly scoped and long-term.
Analytical Perspective: The deployment of reverse SSH tunnels and sophisticated backdoors signals that Tortoiseshell is evolving—moving from opportunistic infiltration to building resilient footholds inside sensitive networks. This development matters because traditional detection methods often overlook outbound channels or DLL side-loading in trusted binaries. As such, security teams can no longer afford to wait for alerts; proactive hunting, continuous external infrastructure monitoring, and inter-organisation sharing of intelligence must become standard practices. What to watch for next: public attribution or disruption of key command-and-control nodes, further targeting of non-traditional sectors, and possible upgrades in evasion techniques aimed at cloud and zero trust environments.
