Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool

Group-IB (citing Kaspersky) reports that the Iranian-linked APT Tortoiseshell (Mirage Kitten) has expanded its toolkit with a new Windows Terminal Server API DLL backdoor and a reverse SSH tunneling utility, enabling covert command-and-control and traffic redirection; the actor has targeted defense and aerospace sectors since at least 2018, is linked to Iran's IRGC, and is reportedly broadening operations into Europe and the Middle East.