The file is called wtsapi32.dll and it looks like a piece of Windows. It forward-exports every legitimate function of the real Terminal Server SDK library, so any program that loads it carries on working normally. What it also does is run one command: an SSH connection out to 172[.]86[.]98[.]113 on port 443, opening a reverse tunnel that lets whoever controls that server reach back into the network the file is sitting in.
Group-IB found that sample while pulling on indicators from Kaspersky's recent reporting. It says the group behind it has been quietly building out a great deal more than one tunnel.
One group, four vendor names
Group-IB tracks the actor as Tortoiseshell, also known as Mirage Kitten, UNC1549 and Nimbus Manticore, an Iranian-nexus group it links to the Islamic Revolutionary Guard Corps. The group has been active since at least 2018 against defence, aerospace, IT service providers and military organisations in the Middle East and the United States, using supply chain compromises, watering hole attacks, fake recruitment websites and custom backdoors. Group-IB rates it among the most active Iranian APT groups of 2026. Our profile of the same cluster is at Mirage Kitten.
An old backdoor, still in service
The second sample is a fresh build of TWOSTROKE, a C++ backdoor that Google's threat intelligence group first documented in late 2025. It wears the same disguise, a counterfeit wtsapi32.dll built to be picked up through DLL search order hijacking, where a legitimate program is tricked into loading the attacker's library instead of the real one. Group-IB's analysis describes a worker thread that fingerprints the host using its fully qualified machine name, scrambles that identifier, and beacons over HTTPS to whichever of three hardcoded servers answers first. The command set is small and practical: upload a file, run a shell command or an executable, load a DLL in memory, pull a file down, list a directory, delete a file, report the username and the machine name.
Servers named after countries
The part Group-IB is most careful about is the infrastructure. Pivoting from a command server domain named in the earlier reporting led to 26 hosts behind two domains, locat[.]sbs and tiktok-u[.]sbs, carrying subdomains that read like a target list: uae1 through uae14, sau1 to sau3, uk1, uk2, bel1, can2, au1 and jp2. Nearly all of them expose the same three ports fronted by the same Caddy web server, which is what a single build recipe looks like. When the registrar suspended tiktok-u[.]sbs, the servers did not move; the same subdomains simply resolved under locat[.]sbs instead.
Group-IB stops short of calling this a confirmed campaign, and it is worth repeating why. No malware samples have been tied to those servers so far, and naming a box uae3 is not evidence that anyone in the UAE was touched. What the naming does suggest is intent, and it reaches further west than this group's documented history, into Europe alongside the Gulf. That fits a pattern of Iranian operators steadily widening their reach, visible again when another Iranian APT hit defence firms with six new spying trojans.
Hunt for the DLL in the wrong place
There is nothing to patch here, so the guidance is detection-led. Group-IB recommends hunting for wtsapi32.dll being side-loaded from anywhere it does not belong, watching outbound HTTPS for traffic matching the beaconing pattern above, deploying targeted YARA rules alongside endpoint detection, and alerting on the command infrastructure listed below. Research by Mansour Alhmoud and Mohamed Emam; the full Group-IB report is here.
Indicators
Reverse SSH tunnelling tool: MD5 07dd28b748656e9e1a870c538d6df68c. TWOSTROKE backdoor: MD5 db58adc4a6c192520ed509b20a928279. Command and control: 172[.]86[.]98[.]113, 185[.]253[.]116[.]81, neexportfolio[.]com, locat[.]sbs and tiktok-u[.]sbs.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.