New Malware, Same Old Game

Iran’s cyber espionage machine never sleeps. Group-IB researchers have just published a deep dive into Nimbus Manticore, an Islamic Revolutionary Guard Corps (IRGC)-affiliated hacking group that’s been quietly expanding its toolkit. The findings reveal a previously undocumented backdoor that borrows heavily from TWOSTROKE, plus a custom SSH tunneler designed to keep covert communications flowing.

This isn’t a flashy ransomware operation. It’s patient, methodical espionage — the kind that targets government networks and critical infrastructure, often for years without detection.

Meet the TWOSTROKE-Like Backdoor

Group-IB’s analysis describes the new backdoor as structurally similar to TWOSTROKE, a known malware family linked to Iranian cyber operations. But it’s not a carbon copy. The researchers found distinct modifications in how the malware handles command-and-control (C2) communications and data exfiltration.

The backdoor operates in phases. It first establishes persistence on the infected host, then reaches out to its C2 server using encrypted channels. Once connected, it can execute arbitrary commands, upload and download files, and even manipulate system processes. The TWOSTROKE-like design makes it harder for defenders to spot — it blends in with legitimate network traffic.

Key Capabilities

• Encrypted C2 communications that mimic normal HTTPS traffic
• Modular command execution for post-exploitation tasks
• File exfiltration with built-in compression and chunking
• Persistence mechanisms that survive system reboots

Group-IB says the code quality is high. This isn’t a rushed job. The malware includes error-handling routines and anti-analysis tricks that suggest experienced developers are behind it.

The SSH Tunneler: A Quiet Workhorse

Alongside the backdoor, Nimbus Manticore deployed a custom SSH tunneler. This tool is deceptively simple: it establishes a secure tunnel between the victim’s network and an external server controlled by the attackers. But that simplicity is what makes it dangerous.

Once the tunneler is in place, the attackers can route traffic through the compromised network as if they were sitting inside it. This allows them to reach internal systems that aren’t directly exposed to the internet — databases, admin panels, or other machines on the same LAN. For a group focused on espionage, that’s gold.

Who Exactly Is Nimbus Manticore?

Nimbus Manticore has been on Group-IB’s radar for a while. The researchers describe the group as one of the most active Iranian APT actors in 2026, with a focus on intelligence gathering rather than sabotage. Their targets have included government entities, telecommunications firms, and research institutions across the Middle East and beyond.

The group operates under the banner of the IRGC, Iran’s ideological military force. That affiliation gives them resources and cover, but it also makes their activities a matter of national security concern for countries on the receiving end.

Attribution and Overlaps

Group-IB’s report notes overlaps with other known Iranian threat actors, suggesting the groups share tools or even personnel. The TWOSTROKE-like backdoor, for instance, bears resemblance to code previously attributed to a different IRGC-linked cluster. This kind of tool-sharing is common in state-sponsored ecosystems — it’s cheaper than developing everything from scratch.

What This Means for Defenders

If you’re responsible for securing a network that might be in Nimbus Manticore’s crosshairs, the takeaway is straightforward: expect stealthy, persistent intrusions that prioritize data theft over disruption. The use of SSH tunneler means you can’t just watch the perimeter — you need to monitor internal traffic for anomalies.

Group-IB recommends several defensive measures:

• Deploy endpoint detection and response (EDR) tools that can spot unusual process behavior
• Monitor outbound connections for encrypted tunnels that don’t match known business applications
• Segment networks to limit lateral movement if one machine is compromised
• Patch vulnerabilities promptly — many initial access vectors exploit known flaws

This isn’t just another APT report. It’s a reminder that Iranian cyber operations continue to evolve, and the tools they use are getting more sophisticated. The TWOSTROKE-like backdoor and SSH tunneler are just the latest additions to an arsenal that shows no signs of shrinking.

For more on related threat activity, check out our analysis of Iranian APT groups targeting critical infrastructure and the broader state-sponsored cyber espionage landscape.

Passkeys Go Multi-Device

WhatsApp has quietly changed how you prove who you are when logging in. The Meta-owned messaging app announced Tuesday that it now supports multiple passkeys per account — a shift that matters more than it might sound.

Until now, you were stuck with a single passkey tied to one device. That was a headache for anyone juggling an iPhone and an Android phone, or switching devices regularly. Now you can register more than one passkey, so logging in from either platform works without friction.

The company says over 1 billion people already use a passkey to access their WhatsApp account. That’s a staggering number, and it shows how quickly the industry has moved away from traditional SMS-based authentication.

For those unfamiliar: a passkey replaces passwords with a cryptographic key stored on your device. You verify with your fingerprint, face scan, or PIN. No more typing in codes from text messages that can be intercepted or phished.

Two-Step Verification Grows Up

The bigger change is in two-step verification (2SV). Previously, WhatsApp locked your account behind a six-digit PIN. Simple, sure, but also predictable. Six digits offer only a million combinations — trivial for a determined attacker to brute-force.

That PIN is now being upgraded to a full password. You can make it longer, and it can include alphanumeric characters and special symbols. In other words, you can finally use something like Tr0ub4dor&3 instead of 123456.

This is a meaningful upgrade. A longer password with mixed characters exponentially increases the difficulty of guessing or cracking it. It also aligns WhatsApp with best practices that security professionals have been pushing for years.

One thing to note: this doesn’t replace your passkey. It’s an additional layer. If someone gets your phone, or you lose it, the 2SV password is still there as a backstop when you re-register your number.

Caller Context: A New Weapon Against Spam

The third feature is Android-only for now, and it’s aimed squarely at the scourge of spam calls.

When an Android user receives a call from someone not in their contacts, WhatsApp will now display additional information about the caller. You’ll see their country of origin and whether they share any WhatsApp groups with you. That’s a small detail that can tell you a lot before you pick up.

If a call comes from a random number in a different country, and you have no mutual groups, you know it’s probably not worth answering. But if you see that the caller is in a group with you — say, a neighborhood association or a work channel — it’s more likely to be legitimate.

“Scammers rely on urgency – now you can take a beat with some more info before answering,” WhatsApp said in its announcement.

That’s the right framing. Spam callers thrive on the moment of panic when the phone rings. A second of context can deflate that urgency entirely.

Building on Scam Alert

This update lands just a couple of weeks after WhatsApp rolled out WhatsApp Scam Alert, an optional feature that uses AI to flag suspicious messages from non-contacts. Together, the two features form a more coherent defense against social engineering.

Scam Alert works by analyzing incoming messages for patterns commonly used in scams — urgency, requests for money, suspicious links — and then warning you before you engage. Caller context extends that protection to voice calls.

It’s a sensible one-two punch. Messaging scams and voice scams often come from the same criminal networks. Blocking both channels makes the platform a harder target.

What This Means for Your Privacy

Some users might wonder whether caller context compromises privacy. Showing your country and mutual groups to a stranger who calls you — isn’t that a data leak?

Not quite. The information is shown only to the person receiving the call, and only when the caller is not in their contacts. It’s a one-way disclosure designed to help the recipient make an informed decision. Your phone number remains hidden unless you choose to reveal it.

WhatsApp has also been pushing WhatsApp username feature to bolster phone number privacy, so users can interact without exposing their digits at all. The two features complement each other: usernames hide your number, and caller context gives you more signal about who’s on the other end.

Security Beyond the Headlines

It’s worth remembering that WhatsApp’s security posture has had its ups and downs. Earlier this year, the company disclosed WhatsApp file spoofing and URL scheme vulnerabilities. Those were patched, but they serve as a reminder that no platform is bulletproof.

The new passkey and 2SV features are steps in the right direction, but they only work if you actually enable them. Passkeys are on by default in many cases, but the 2SV password — the upgrade from the old PIN — requires you to set it up.

Here’s what you should do right now:

• Open WhatsApp Settings and check your passkey registration. If you use multiple devices, register a passkey on each one.
• Update your two-step verification to a full password. Make it long, unique, and not reused anywhere else.
• Turn on Scam Alert if you haven’t already. It’s optional, but it’s free protection.
• If you’re on Android, pay attention to the new caller context screen. It could save you from a scam call.

Security is a process, not a product. WhatsApp’s latest update gives you better tools — but the final layer of protection is still you.

The Patch Is a Confession

Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system that hasn’t updated yet.

This is N-day exploitation, and it’s always been a race. The vendor patches, the clock starts, and defenders try to deploy before attackers reverse-engineer the fix. But here’s the uncomfortable truth: the race is getting shorter. What used to be an N-day window—days of relative safety—is now shrinking to N-hour. Sometimes even N-minute.

Why the Window Is Collapsing

Attackers aren’t waiting around. Automated tooling can now analyze a patch and produce a working exploit in hours, not weeks. The barrier to entry has dropped dramatically. You don’t need to be a reverse-engineering wizard anymore; you just need the right scripts and a bit of patience.

Meanwhile, the average enterprise takes weeks to patch critical systems. Not because teams are lazy—but because patching production environments is risky. A bad update can break applications, cause downtime, and cost more than the vulnerability itself. So defenders are stuck between a rock and a hard place: patch fast and risk stability, or patch slow and risk compromise.

It’s a lose-lose scenario, and it’s only getting worse.

The False Comfort of ‘We Patch Within 48 Hours’

Many security teams pride themselves on patching within 48 hours. That’s admirable, but it’s not enough anymore. If the exploit is weaponized within six hours of the patch release, your 48-hour SLA leaves you exposed for a full two days.

Let’s put some numbers on this. Research from the Kaspersky threat research team shows that the median time between a patch release and a working exploit appearing in the wild has dropped to under 24 hours for some high-profile vulnerabilities. For critical CVEs, that window can be even tighter.

The Problem With Patching Everything

You can’t just patch everything faster. That’s a recipe for chaos. Instead, you need to triage. Not all vulnerabilities are created equal, and not all systems are equally exposed. A vulnerability in an internet-facing web server is a much bigger deal than one in an internal tool with limited access.

So what do you do? You prioritize. You focus on the vulnerabilities that are both exploitable and reachable. You patch those first, even if it means breaking your normal change management process.

What Actually Works: A Three-Layer Defense

Relying on patch speed alone is a losing strategy. Here’s what security teams should be doing instead.

• Know your attack surface. You can’t protect what you don’t know about. Maintain an up-to-date asset inventory, and understand which systems are exposed to the internet, which hold sensitive data, and which are critical to operations.
• Deploy virtual patching. Web application firewalls (WAFs) and intrusion prevention systems (IPS) can block exploit attempts even before you’ve applied the vendor patch. This buys you time without the risk of a hasty update.
• Assume breach. Even with perfect patching, something will slip through. Have detection and response capabilities that can catch an attacker who’s already inside your network. The faster you spot them, the less damage they can do.

These layers don’t replace patching—they augment it. They give you the breathing room to patch properly, without the panic of an imminent exploit.

Automation: Your Only Real Advantage

Manual patching is dead. There’s simply too much to do, and the window is too short. You need automation that can deploy critical patches across your environment in minutes, not days.

But automation isn’t a silver bullet either. You still need humans to make the tough calls about what to patch first, when to break the change window, and how to handle exceptions. The key is to combine machine speed with human judgment.

And don’t forget the basics. Segment your network so a compromise in one area doesn’t spread everywhere. Enforce least-privilege access so even if an attacker gets in, they can’t move laterally. These are old-school practices, but they remain incredibly effective.

The Bottom Line: Plan for the Worst

N-day exploitation is becoming N-hour exploitation. That’s the new reality, and it’s not going to reverse. The attackers have the advantage of speed, and they’re not giving it up.

So stop pretending that a faster patching process will save you. It won’t. Instead, build a defense that assumes you’ll be hit, and focuses on reducing the blast radius. Patch what you can, as fast as you can, but never rely on it as your only line of defense.

The race is getting shorter, but you can still win it—if you change the game.

Related Reading

For more on how attackers operate and how to defend against them, check out zero-day exploit prevention strategies and practical incident response playbooks.