Expands Toolset With New Backdoor, SSH Tunnel

Tortoiseshell, an Iranian-affiliated cyber-espionage group active since 2018, has introduced new malware components: a reverse SSH tunneling tool masquerading as wtsapi32.dll that leverages Windows OpenSSH to establish command-and-control connections, and a C++ backdoor with capabilities for file execution, shell command execution, in-memory DLL loading, and file manipulation. The backdoor shares similarities with the TWOSTROKE malware family. Analysis of their infrastructure reveals domains with subdomains referencing multiple countries, suggesting an expansion of their targeting scope beyond traditional sectors and regions. Despite domain suspensions, the group continues operations with persistent infrastructure. There is no indication of publicly available patches or active exploitation in the wild.

The malware enables persistent remote access and control over compromised systems, allowing the threat actor to execute arbitrary files and commands, manipulate files, and load DLLs in memory. This facilitates espionage activities and potentially data exfiltration. The expanded targeting to multiple countries and sectors increases the risk to a broader range of organizations, especially in defense, aerospace, IT services, and military domains. However, no active exploitation or widespread incidents have been reported.

No official patches or fixes are available for this malware. Organizations should monitor for indicators of compromise such as the domains locat.sbs and tiktok-u.sbs and be vigilant for suspicious use of wtsapi32.dll or unexpected SSH tunneling activity. Standard endpoint detection and response tools should be updated to detect behaviors associated with this backdoor and SSH tunneling utility. Network segmentation and restricting outbound SSH connections may help reduce exposure. Since no vendor advisory indicates otherwise, these mitigations are recommended based on the malware's described behavior.