# Iran's Nimbus Manticore Is Quietly Getting Better at Staying Hidden
Most Iranian APT groups get loud. They deploy wipers, leak documents to embarrass governments, make themselves known. Nimbus Manticore is doing the opposite — and that's what makes Group-IB's latest analysis worth paying close attention to.
The cybersecurity firm published new findings today on Nimbus Manticore, the IRGC-affiliated espionage actor it's flagged as one of the most active Iranian threat groups of 2026. What Group-IB found isn't a dramatic zero-day or a fresh campaign against a major target. It's something quieter and, in some ways, more telling: an expanded toolkit, including a previously undocumented backdoor with functional similarities to TWOSTROKE, and a custom SSH tunneler built for persistence.
The details matter here. Expanding toolsets is how APT groups signal maturity.
## The TWOSTROKE Connection
TWOSTROKE has circulated in threat intelligence circles as a reference point for a specific class of lightweight, modular backdoor — designed to minimize footprint, blend into legitimate traffic, and survive reboots without leaving obvious artifacts. Nimbus Manticore's new implant doesn't appear to be a direct fork, but the architectural echoes are deliberate. This group is clearly studying what works.
The SSH tunneler is perhaps the more operationally interesting piece. SSH tunneling is an old technique — defenders have known about it for decades. But it's had a quiet renaissance among state-sponsored actors precisely because it's so mundane. SSH traffic on port 22 (or disguised on 443) doesn't generate the same alerts that C2 over exotic protocols does. When you're running a long-haul espionage operation against a government ministry or defense contractor, you don't want drama. You want to be the background noise nobody investigates.
Combining a stealthy backdoor with SSH-based tunneling suggests Nimbus Manticore is optimizing for dwell time — the period between initial compromise and detection. The longer they stay undetected, the more intelligence they collect.
## Who's Getting Hit
Group-IB's reporting stops short of naming specific victims in this latest analysis, but Nimbus Manticore's historical targeting profile gives the pattern away. IRGC cyber units have consistently gone after Middle Eastern government agencies, regional telecoms, defense-adjacent contractors, and — increasingly — targets in Europe and Central Asia with strategic relevance to Iranian foreign policy objectives.
The 2026 designation as "most active" isn't a marketing superlative. Iran's cyber program has been on an upward trajectory since at least 2022, accelerated by geopolitical pressure and the practical need to gather intelligence through means that don't risk direct military confrontation. Nimbus Manticore fits that logic perfectly: a sophisticated, patient operator running long-term collection campaigns rather than one-off disruption attacks.
That's a different threat model than, say, a ransomware crew. The organizations most at risk here aren't running legacy software in obvious ways — they're running modern infrastructure that may have been silently compromised months or years ago.
## What the Tunneler Tells Us
SSH tunneling in APT operations usually means one of three things: the attackers need a reliable exfiltration channel, they want to pivot laterally through a network without triggering EDR rules written for more exotic protocols, or they're establishing a persistent access mechanism that survives perimeter changes like firewall rotations and IP blocks.
All three are plausible for Nimbus Manticore's known operational patterns. If the group is running long-term collection against government targets, reliable exfiltration matters enormously. Documents, email archives, and credential stores need to flow out cleanly — ideally without triggering DLP tools that watch for large encrypted transfers over unknown endpoints.
The SSH channel solves that. Route your exfil through an SSH tunnel to a legitimate-looking relay, and it looks like a sysadmin connecting to a jump box. That's not a new trick, but it's one that still works.
## The Expanding Arsenal Problem
There's a broader pattern worth naming: Iranian APT groups are getting faster at absorbing and adapting techniques from other threat actors. The TWOSTROKE-like design in Nimbus Manticore's new backdoor isn't coincidence — it reflects a development process that watches what works across the ecosystem and replicates it.
This is different from earlier Iranian cyber operations, which often relied on cruder tools and made detection easier. Groups like Charming Kitten (APT35), Moses Staff, and Agrius have each evolved in this direction over the past several years. Nimbus Manticore now appears to be following the same trajectory, adding custom-built, evasion-conscious tooling rather than relying on off-the-shelf malware.
For defenders, that evolution matters. Signature-based detection built around older Iranian malware families will miss this. Behavioral detection — watching for unusual SSH traffic, unexpected process chains, or persistence mechanisms that don't match known software baselines — is where you need to be investing.
---
## HackWire Analysis
The Group-IB report on Nimbus Manticore lands at an interesting moment. Iranian cyber operations are under renewed scrutiny following a series of attribution controversies in 2025, and there's been a tendency in some quarters to underestimate IRGC-affiliated actors relative to their Russian and Chinese counterparts. This analysis challenges that framing directly.
The TWOSTROKE-like backdoor is significant not for what it does — which appears relatively conventional — but for what its existence signals about Nimbus Manticore's development capacity. A custom-built implant with design inspiration drawn from known effective tools is not the work of a low-resourced crew. This is an operation with dedicated development, testing infrastructure, and enough operational security discipline to keep previously undocumented tools off the radar until Group-IB found the new infrastructure.
The SSH tunneler compounds the concern. The organizations most likely targeted by Nimbus Manticore — government ministries, defense contractors, telecoms in strategically relevant regions — tend to have reasonably mature perimeter security. They're not easy marks. But perimeter security doesn't stop SSH tunneling when the tunnel is already inside, established via an initial access vector that could be months old.
What's missing from most coverage of this story is a concrete call to action for the sectors actually at risk. Defenders in government and critical infrastructure should be auditing outbound SSH connections — specifically looking for connections to non-standard destinations, high-frequency low-bandwidth sessions that could indicate slow exfiltration, and any SSH activity initiated by processes that shouldn't be establishing network connections. If your threat model includes Iranian state actors (and for Middle Eastern governments and their regional partners, it absolutely should), this is the week to pull those logs and look hard.
One more thing: the "most active Iranian APT of 2026" designation, if it holds through the rest of the year, should put Nimbus Manticore into every threat intelligence briefing for sectors that routinely appear in IRGC targeting profiles. This isn't a group to watch passively.
— HackWire Editorial
---
## Related Coverage