Expands Toolset With New Backdoor, SSH Tunnel

Reported 26 Aug 2026 by otx · Severity: medium

An Iranian-linked cyber-espionage group known as Tortoiseshell has enhanced its malware arsenal with newly identified tools, including a reverse SSH tunneling utility and a C++ backdoor. The SSH tunnel, disguised as wtsapi32.dll, leverages Windows OpenSSH client to establish conn