Iran-Linked Hackers Use Reverse SSH Tunnels to Reach Deep Inside Compromised Networks

Iran-linked threat actor Tortoiseshell is expanding its espionage toolkit with reverse SSH tunneling utilities and a TWOSTROKE-like backdoor designed to give operators covert, durable access to compromised internal networks.

The research began with public reporting from Kaspersky on Mirage Kitten’s newer malware ecosystem, which included the NightLedger backdoor and WebSocket tunneling tools ArcBridge and BridgeHead.

Group-IB then enriched known indicators and conducted additional hunting, uncovering a broader infrastructure footprint, previously unreported samples, and evidence of continued development around remote access and lateral-movement capabilities.

Tortoiseshell has operated since at least 2018 and has historically focused on defence, aerospace, IT service providers, and military-linked entities across the Middle East and the United States.

The actor has been associated with supply-chain compromises, watering-hole operations, fake recruitment portals, custom malware, and activity assessed by multiple researchers as aligned with Iranian state interests.

One newly identified component is a 64-bit DLL named wtsapi32.dll, posing as the legitimate Windows Terminal Server SDK API. The sample forwards legitimate exports to preserve expected application behavior, a characteristic consistent with DLL search-order hijacking and side-loading operations.

Behind that façade, the implant invokes the native Windows OpenSSH client to create a reverse SSH tunnel to attacker-controlled infrastructure at 172[.]86[.]98[.]113 over port 443.

The command uses options disabling host-key verification and redirects a remote listener back into the victim environment through -R 1081.

In effect, connections to localhost:1081 on the operator’s server can be relayed through the encrypted SSH session into the breached network.

This approach is operationally significant. Rather than exposing a victim host to inbound connections, the compromised machine initiates an outbound encrypted session often a more firewall-friendly and less conspicuous pattern.

Google Threat Intelligence Group previously observed UNC1549 using reverse SSH tunnels to forward traffic from C2 infrastructure into victim networks, reducing the amount of actionable host-level forensic evidence left during follow-on operations.

Group-IB’s latest investigation links the activity to the cluster also tracked as Mirage Kitten, UNC1549, and Nimbus Manticore.

Reverse SSH Tunnels

Group-IB also found a second wtsapi32.dll sample with strong similarities to TWOSTROKE, a C++ backdoor documented by Google in late 2025.

The malware dynamically resolves Windows APIs, decrypts sensitive strings at runtime, and launches a worker thread to manage C2 communications through WinHTTP.

The implant generates a victim identifier from the system’s fully qualified domain name, XOR-encrypts it using the key Pn, hex-encodes the result, and transforms the trailing portion before transmitting it in an HTTPS POST request.

The reported sample includes three fallback C2 endpoints: neexportfolio[.]com, neexportfolio.azurewebsites[.]net, and neexportfolio.eastus.cloudapp.azure[.]com.

Once connected, the backdoor can receive commands to exfiltrate files, download payloads, run executables or shell commands, load DLLs in memory, enumerate directories, gather usernames and hostnames, and delete files.

Its use of the @##@ delimiter for command fields further aligns with tooling previously attributed to UNC154.

Pivoting from the known aecert[.]org C2 domain led Group-IB to infrastructure tied to 185.253.116[.]81 and domains including locat[.]sbs and tiktok-u[.]sbs.

Subdomains such as uae1 through uae14, sau1 through sau3, uk, bel, can, au, and jp appear to map infrastructure by country or operational segment.

Monitoring vendor access, cloud-hosted C2 lookalikes, DLL side-loading behavior, and unexplained local proxy listeners is equally important as Tortoiseshell continues to blend custom implants with legitimate Windows components.

While researchers cautioned that infrastructure alone cannot establish the intended use of these servers, the geographic naming pattern and continuity of server mappings after tiktok-u[.]sbs was suspended suggest an environment built for resilient, distributed operations.

For defenders, the priority is to hunt for unusual ssh.exe executions from Windows hosts particularly reverse forwarding options such as -R, outbound SSH over port 443, DLLs impersonating wtsapi32.dll, and connections to the identified C2 infrastructure.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide