Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

Summary

Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC). Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026. Nimbus Manticore (aka

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.