Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

Cybersecurity researchers discovered additional infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps. Group-IB described the group as among the most active Iranian APT groups in 2026. The new findings include a TWOSTROKE-like backdoor and an SSH tunneler, expanding the group's toolset.