APT34 Leverages New Backdoor and Reverse SSH for Broader Attacks

Key Takeaways

• The Iran-linked APT group Tortoiseshell (also known as Mirage Kitten, UNC1549, and Nimbus Manticore) has expanded its cyber espionage toolkit.
• New tools include a Windows backdoor and a reverse SSH tunneling utility, enhancing persistence and internal network access.
• The group targets defense, aerospace, IT service providers, and military organizations, with expanding reach into the Middle East and Europe.
• Attackers leverage techniques like DLL search-order hijacking and masquerading as legitimate Windows libraries.
• No specific patch is available for these techniques; mitigation relies on robust security practices and vigilance against unusual network activity.

A persistent Iranian state-sponsored advanced persistent threat (APT) group, known as Tortoiseshell, has significantly enhanced its cyber espionage capabilities. Researchers have uncovered new tools in the group’s arsenal, including a sophisticated Windows backdoor and a reverse SSH tunneling utility, designed to grant deeper and more resilient access to compromised networks.

This expansion provides Tortoiseshell, also tracked under aliases such as Mirage Kitten, UNC1549, and Nimbus Manticore, with more robust methods to maintain a foothold within victim environments. The tunneling tool facilitates the covert routing of traffic from attacker-controlled servers back into a compromised network, while the new backdoor offers extensive functionalities for command execution, file manipulation, and system reconnaissance.

Analysts at Group-IB identified these new malicious components and associated infrastructure by enriching existing indicators of compromise (IoCs) and conducting targeted threat-hunting operations. Their findings, detailed in a Group-IB said in a report, suggest that Tortoiseshell is actively broadening its operational scope, now targeting organizations across the Middle East and Europe.

Active since at least 2018, Tortoiseshell has historically focused its attacks on critical sectors including defense, aerospace, IT service providers, and military organizations. The group’s initial access methods frequently involve supply-chain compromises, exploitation of compromised websites, and the use of deceptive recruitment portals. This necessitates heightened user vigilance and the implementation of robust, layered security measures by potential targets.

The research underscores the ongoing threat posed by Iranian-linked cyber operations, particularly to entities handling strategic or government-adjacent information. The continuous evolution of Tortoiseshell’s toolkit elevates the risk for regional defenders grappling with persistent espionage campaigns, with high-value sectors remaining particularly vulnerable.

Iran-Linked Hackers Expand Attacks

One of the newly discovered components is a malicious DLL designed to impersonate a legitimate Windows library named wtsapi32.dll, which is typically associated with Terminal Server functions. This component cleverly passes legitimate functions through to avoid immediate suspicion while simultaneously establishing a covert reverse SSH connection over port 443 to an attacker-controlled server.

This reverse SSH tunneling capability is critical because the connection originates from within the victim’s network. Once established, it allows traffic directed to a specified port on the remote attacker server to be covertly channeled back into the compromised environment. This technique effectively enables intruders to access internal systems without creating an easily detectable inbound network path.

Reverse tunnels have become a favored technique among threat actors for maintaining access post-breach. This method is analogous to other reverse tunnel attack concerns, where outbound connections similarly bypass conventional network perimeter defenses.

The second identified malware sample is a C++ implant, bearing a resemblance to the previously documented TWOSTROKE backdoor. This implant also disguises itself as wtsapi32.dll and appears specifically engineered for DLL search-order hijacking. This technique exploits how legitimate applications load dynamic-link libraries, tricking a trusted program into loading a malicious, attacker-controlled library instead of the authentic one.

The backdoor further enhances its stealth by obfuscating critical text until runtime. It generates a unique identifier based on the infected device’s hostname and communicates with hardcoded command-and-control (C2) servers via HTTPS. Its capabilities include uploading and exfiltrating files, executing programs or shell commands, loading DLLs directly into memory, downloading additional files, and listing directory contents.

This reliance on abusing trusted Windows loading behavior echoes the tactics observed in malware abusing DLL search order. For cybersecurity defenders, the presence of an unfamiliar wtsapi32.dll file alongside an application warrants immediate investigation rather than being presumed legitimate.

Infrastructure Points to Wider Reach

Group-IB’s investigation extended to identifying additional infrastructure linked to Tortoiseshell by pivoting from a known command-and-control domain. Their analysis revealed a network of domains and subdomains configured with country-specific labels, indicating potential targets or staging areas in the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia, and Japan.

While the researchers caution that infrastructure alone does not conclusively prove its ultimate use, particularly since not all nodes had matching malware samples identified, the geographical naming patterns, combined with the continued operation of servers even after a related domain was suspended, strongly suggest a premeditated expansion. This preparation should be a significant concern for defenders.

These findings reinforce a crucial lesson drawn from APT attacks on RDP servers: persistent threat groups routinely establish multiple routes into a network. A secondary tunnel or backdoor can ensure an operation remains viable even if the primary access method is detected and neutralized.

What You Should Do

• Continuous Threat Hunting: Actively search for unusual DLL side-loading activities, unexpected outbound SSH connections, and repetitive HTTPS beaconing patterns.
• Endpoint Detection and Response (EDR): Deploy and optimize EDR solutions with focused detection rules to identify anomalous process behavior and file modifications.
• Review Connections: Regularly audit and review network connections to known Tortoiseshell infrastructure, using the provided Indicators of Compromise (IoCs).
• Information Sharing: Share confirmed sightings and threat intelligence with trusted security partners and industry groups to foster collective defense.
• Network Monitoring: Pay close attention to SSH processes originating from unusual Windows executables and any connections on port 443 that do not align with typical web traffic patterns.
• SSH Anomaly Detection: Implement monitoring for SSH-based backdoor warning signs, which can significantly reduce the time between an intrusion and its containment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.