Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

Researchers have found new infrastructure and undocumented malware linked to Nimbus Manticore, a hacking group sponsored by the Iranian state and affiliated with the Islamic Revolutionary Guard Corps. The group is considered one of the most active Iranian advanced persistent threat groups this year. Nimbus Manticore's toolset has been expanded with a backdoor similar to TWOSTROKE and an SSH tunneler. The discovery was made by Group-IB in a recent analysis. Nimbus Manticore is also known by another name, although the details of this alias are not specified. The group's activities are focused on cyber espionage.