Executive Summary

Cybersecurity researchers uncovered new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state‑sponsored hacking group tied to the IRGC. The analysis, released by Group‑IB, reveals the addition of a TWOSTROKE‑like backdoor and an SSH tunneler to the group’s arsenal, marking it as one of the most active Iranian APT actors in 2026.

---

Intelligence Metadata - Source Publisher: The Hacker News - Published Date: 2026-08-26T15:35:05+00:00 - Category: threat-intel

Original Description: Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC). Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026. Nimbus Manticore (aka

"He that is giddy thinks the world turns round."

— William Shakespeare