Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel

Group-IB reported that Iranian-linked APT Tortoiseshell expanded its toolset with a reverse SSH tunneling utility and a C++ backdoor, both disguised as wtsapi32.dll to enable DLL side-loading; the backdoor supports HTTPS C2, file/shell commands and in-memory DLL execution. Related infrastructure (domains and country-specific subdomains) resolved to active servers spanning the Middle East and Europe, suggesting wider targeting, and researchers recommend persistent hunting for wtsapi32.dll side-loading and monitoring outbound traffic to known C2s.