Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC). Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026. Nimbus Manticore (aka

Report facts: The article describes Nimbus Manticore, an Iranian state-sponsored APT group, expanding its toolset with new malware, including a TWOSTROKE-like backdoor and SSH tunneling capabilities, as part of broader cyber espionage activity attributed to the IRGC in 2026. The focus is on newly discovered infrastructure and previously undocumented malware used for persistent access and covert data exfiltration. RealGround analysis: While the report does not explicitly reference AI, such state-backed implants and tunneling tools can be used to compromise AI infrastructure, exfiltrate AI models or training data, and establish long-term access to AI-enabled systems. Organizations operating critical AI workloads should treat this as a reminder to harden access control, monitor for unusual tunneling behavior, and regularly red team AI environments against advanced persistent threats.