Mirage Kitten Toolset Expansion: Reverse SSH Tunnelling, TWOSTROKE, NodeRabbit and PollCat

Two vendor reports published a week apart in late August and early September 2026 cover the same Iranian nexus actor. Group-IB tracks it as Tortoiseshell and Kaspersky as Mirage Kitten; it is also tracked as UNC1549 and Nimbus Manticore, and is affiliated with the Islamic Revolutionary Guard Corps. The group has been active since at least 2018 against defence, aerospace, information technology service providers and military organisations, and the newer reporting adds confirmed victims in financial technology and in aviation across the Middle East and Africa. Its established methods include supply chain compromise, watering hole attacks and recruiter personas on professional networks.

Group-IB identified two previously unreported native components, both Windows libraries named after a genuine system library and both passing every call on to the real one so the program that loads them keeps working normally. The first opens a reverse tunnel: it drives the operating system's own secure shell client out to an operator controlled server on a web port, disables the checks that would otherwise prompt, and asks that server to forward a port back down the connection, giving the operator a route into the network from their own machine. The second is a new build of the TWOSTROKE backdoor, which reports to the first of three hardcoded servers that answers and takes commands to move files, run programs, enumerate the host and delete traces.

Kaspersky documented a newer direction, the group's first implants written in Node.js and JavaScript, named NodeRabbit and PollCat. Both run on Windows, Linux and macOS from a single codebase, and both arrive as trojanized coding challenge archives sent by fake recruiter accounts on job search platforms, hosted on cloud storage and pressed on the target under a short deadline. The archives carry a tampered dependency bundled into the project rather than published publicly, so running the exercise is enough to start the implant in the background. Later variants check whether they are being analysed and exit if they are, and route their traffic through whatever corporate proxy they find.

Persistence in both implants hides behind vendor names. Each copies itself into an application data folder named for a browser updater, a driver support assistant or a networking component, places a copy of the interpreter beside it, and points an autostart entry or a daily task at the pair. The newest variant also works through developer habits, installing a fake editor extension presented as a coding assistant and adding a launcher to a repository's version control hooks so a later routine branch switch starts it again. That variant collects mail account addresses and looks for installed security products.

The infrastructure differs between the two toolsets. The native tooling sits behind a pool of twenty seven rented relay servers reached through short country named subdomains across two registered domains, one active and one suspended by its registrar, and the servers did not move when the suspended name was withdrawn. The Node implants instead use cloud application hosting and domains behind a large content delivery network, in some cases building the target organisation's own name into the address so the traffic reads as that organisation's own service.