Iran-Linked Hackers Use Reverse SSH Tunnels to Reach Deep Inside Compromised Networks

Iran-linked Tortoiseshell (aka Mirage Kitten / UNC1549) is expanding its espionage toolkit with a 64-bit DLL (wtsapi32.dll) that side‑loads and spawns OpenSSH to create reverse SSH tunnels to attacker servers, plus a TWOSTROKE-like WinHTTP backdoor capable of file exfiltration, command execution, DLL loading, and reconnaissance; Group-IB linked new samples and infrastructure (IPs/domains/hashes) and recommends hunting for outbound SSH over 443, ssh.exe with -R, DLL impersonation, and the provided IOCs.