Iran-Linked Tortoiseshell Group Deploys Malicious wtsapi32.dll Backdoor for Persistent Windows Access
Researchers have identified new tools used by the Tortoiseshell group, an Iranian-linked operation also tracked as Mirage Kitten, UNC1549, and Nimbus Manticore. The campaign relies on a Windows backdoor and reverse SSH tunnels to maintain long-term access to compromised networks.
Active since at least 2018, the group has a history of targeting organizations in the defense, aerospace, technology, IT services, and military sectors, mainly in the Middle East and the United States. One of the newly discovered tools masquerades as the legitimate wtsapi32.dll file.
The malware retains the expected functions of the Windows library while silently initiating a reverse SSH connection to the attackers’ infrastructure. Communication occurs over port 443, allowing operators to forward traffic from the command-and-control server directly into the victim network without requiring direct inbound connections.
The implant can execute programs and commands, download and exfiltrate files, load DLLs directly into memory, list directories, and collect information about the infected user and computer. The investigation also revealed infrastructure linked to countries including the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia, and Japan.
Related articles
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.
APT28 Expands Espionage with New HOOKEDGE Backdoor Targeting European Organizations
The Russian-linked APT28 group, also known as BlueDelta, has deployed a new lightweight backdoor called HOOKEDGE as part of a cyber-espionage campaign against strategic European entities. The attacks, assessed with moderate confidence, targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Turkey between September 2025 and April 2026. Infection begins with spear-phishing emails delivering Microsoft Word documents containing malicious macros that mimic official Spanish government materials. Upon execution, the macros drop files, establish persistence via scheduled tasks, and deploy the HOOKEDGE backdoor written in batch scripts. The malware uses hidden Microsoft Edge instances and the legitimate webhook.site service to blend command-and-control traffic with normal web activity. In high-value victims, operators installed a second HOOKEDGE instance with five-minute check-ins for faster control and data collection. The backdoor shows strong code similarities to the older HEADLACE implant previously attributed to the same group.
Iran-Linked Cyber Attack Leaves Small UK Power Plant Offline for Four Days
A cyber attack attributed to hackers with suspected ties to Iran took a small-scale UK power generation facility offline for approximately four days in July 2026. The incident affected a roughly 15 MW generator used to support peak demand periods, yet caused no customer outages or disruption to the national electricity grid. British authorities have not issued an official attribution, and investigators have not publicly identified the malware, vulnerability, or initial access vector used in the operation. Recovery required four days of extensive validation across controllers, configurations, security systems, and remote access points to ensure no residual risks remained. The case highlights the operational challenges of restoring industrial control environments after suspected nation-state activity. In response, UK authorities have strengthened guidance for the energy sector and are considering additional protective measures for critical infrastructure suppliers.
HoneyMyte APT Deploys Kernel-Level CoolClient Backdoor Disguised as Microsoft Defender
The Chinese-speaking APT group HoneyMyte has deployed an updated version of its CoolClient backdoor in espionage operations targeting government and private organizations in Russia, Myanmar, Mongolia, Pakistan, and India. The new variant operates at the Windows kernel level using a signed driver, allowing it to hide processes, files, registry entries, and network activity while evading detection. Attackers first abuse PlugX to add exclusions for Microsoft Defender, then drop a fake Windows Defender directory containing the renamed Sangfor binary defender.exe and the malicious libngs.dll. A scheduled task ensures persistence by launching the fake defender.exe with high privileges on system startup. Kaspersky GReAT researchers note that the kernel-mode capabilities significantly increase the backdoor’s stealth and survivability compared to its previous user-mode implementation. The campaign demonstrates sophisticated living-off-the-land techniques combined with legitimate software abuse.