Iran-linked hackers expand infrastructure across Europe and Middle East, report says

Group-IB researchers linked new servers and domains in the UK, Belgium, Saudi Arabia and the UAE to the Iranian APT 'Tortoiseshell', and identified new malware samples including a TwoStroke-like backdoor and a reverse SSH tunnel tool, suggesting the group is expanding its geographic reach and maintaining sophisticated espionage capabilities against defense, aerospace, and technology targets.