Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

thehackernews.com Aug 27, 2026

Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler

Curated by Shubham · TechCapsules · Aug 27, 2026

AI-summarised brief · reviewed before publication

Cybersecurity firm Group‑IB has uncovered new infrastructure and previously unknown malware linked to Iran’s state‑sponsored APT group Nimbus Manticore, also known as GalaxyGato and several other aliases. The researchers say the group, tied to the Islamic Revolutionary Guard Corps and related to the Tortoiseshell/Charming Kitten cluster, is among the most active Iranian actors in 2026. Findings include a reverse‑SSH tunneling utility that pretends to be the Windows Terminal Server SDK API and connects to a hard‑coded server (172.86.98[.]113:443), and a C++ backdoor resembling the TWOSTROKE implant. Both tools enable persistent access, system data collection, file manipulation and command execution. The infrastructure spans Europe and the Middle East, suggesting an expanded targeting profile beyond the group’s historic focus on defense and aerospace sectors.

💡 Why It Matters

· By integrating a disguised SSH tunnel and a TWOSTROKE‑like backdoor, Nimbus Manticore can stealthily maintain footholds across a broader geographic swath, giving Iran a more resilient channel for espionage against strategic industries.

Capsules Cybersecurity

Read full article on thehackernews.com

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA released an advisory (AA26‑237A) detailing two simultaneous red‑team tests against critical infrastructure. Both attacks compromised the domain and accessed sensitive business systems and cloud resources, yet outcomes diverged. Organization A, a government services entity, was fully breached with no detection, owing to fragmented SOCs, false‑positive alerts, and weak escalation procedures. Organization B, a water‑and‑wastewater system, detected and isolated phishing attempts within minutes, preventing lateral movement. The study highlights that tool effectiveness hinges on people, processes, and procedures.

💡 The contrast shows that even identical attack techniques can fail or succeed based on internal response maturity, underscoring the need for unified SOC visibility and robust incident‑handling protocols.

thequantuminsider.com · Aug 27

CypherGenics Launches FASTKAT for Quantum-Ready Security

CypherGenics announced the launch of FASTKAT, a patented security platform that delivers quantum‑ready identity, authentication, and encryption for enterprises and critical infrastructure. The technology leverages the company’s U.S. patent portfolio, including patents on digital ecosystems, encryption, digital signatures, trusted execution, and blockchain verification. FASTKAT targets the growing threat of quantum computing and AI‑driven attacks, aiming to secure connected devices, systems, and AI identities without the performance limits of traditional PKI. The company claims the solution is scalable for low‑power, low‑bandwidth environments.

💡 FASTKAT addresses the urgent need for scalable, quantum‑resistant security in an era of rapid AI deployment, positioning enterprises to preemptively shield critical infrastructure from emerging cryptographic threats.

playstationlifestyle.net · Aug 27

‘Heartbreaking for Our Team’: Rockstar Addresses GTA 6 Leak

Rockstar Games addressed recent Grand Theft Auto VI gameplay leaks, describing the unauthorized release as “heartbreaking” for its development team. The studio acknowledged the distress caused by the premature exposure, stating this was not the intended way for fans to experience the highly anticipated title. Rockstar confirmed that the leaks have impacted the game with spoilers ahead of its scheduled launch. Despite these setbacks, the developer promised fans an excellent experience with the new installment. The leaker, identified as Cyberleek, continued sharing content, including a clip of protagonist Jason stealing cars, shortly after Rockstar’s statement. Netflix subscribers will receive special teaser trailer footage featuring main characters Jason and Lucia this week. The game is set for a global release on November 19, 2026, exclusively for PlayStation 5 and Xbox Series X|S consoles. Rockstar emphasized that the game is nearly finished, aiming to mitigate disappointment among the waiting community while managing the fallout from the security breach that exposed crucial gameplay aspects and map details of the fictional state of Leonida.

💡 The persistent leaks undermine Rockstar’s carefully orchestrated marketing strategy, forcing a reactive stance that diminishes the exclusivity of the upcoming Netflix teaser. This breach exposes the vulnerability of major AAA titles to insider threats, potentially altering how studios manage pre-launch security and community engagement for blockbuster franchises.

thehackernews.com · Aug 26

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

The U.S. Department of Justice announced the takedown of two Chinese‑operated hacking platforms, QScan and QTRouter, used by the state‑sponsored QTFY group to infiltrate critical U.S. infrastructure. Operated by Nanjing Xinjiuwei Network Technology, the tools compromised IoT devices worldwide and routed traffic through a mesh of leased servers and proxy services to mask the attackers’ origin. Victims included NASA, the Federal Reserve, the Department of Energy, the Department of Justice, HHS, NIH, and the Senate. The FBI described the infrastructure as a global botnet that blended malicious traffic with legitimate users, making detection by IP‑based defenses difficult. The disruption was achieved by court‑authorized seizure of hard‑coded domains, effectively shutting down the botnet after years of activity since 2018.

💡 By dismantling the obfuscation network, U.S. authorities have removed a key layer that let Chinese cyber operatives conduct covert espionage against high‑value government and research targets.

quantumcomputingreport.com · Aug 26

Quantum eMotion Submits Quantum Entropy Source for NIST SP 800-90B Validation

Quantum eMotion Corp. has submitted its eCore-Q PCIe Quantum Entropy Module for official validation under the National Institute of Standards and Technology’s Cryptographic Module Validation Program. The submission targets compliance with NIST SP 800-90B, a rigorous standard for non-deterministic random number generators used in federal and high-security cryptographic infrastructure. Cybersecurity laboratory Lightship Security Inc. independently assessed the hardware, documenting the physical unpredictability of Quantum eMotion’s electron-tunneling Quantum Random Number Generator chiplet. This validation is a mandatory prerequisite for achieving FIPS 140-3 certification, enabling system integrators to incorporate the module into regulated products for government, healthcare, and enterprise finance sectors. The move strengthens Quantum eMotion’s integrated security stack, which combines its eFlux-Q entropy stream with the eShield-Q runtime memory protection platform and SecureKey™ zero-exposure credential architecture. CEO Francis Bellido expects this progress to expand market access across North American defense, cloud IT, and critical infrastructure sectors, reinforcing the company’s position in quantum cybersecurity.

💡 Achieving NIST SP 800-90B validation unlocks the mandatory pathway to FIPS 140-3 certification, a strict barrier to entry for federal and financial hardware contracts. This technical milestone transforms Quantum eMotion’s quantum entropy technology from a theoretical advantage into a compliant, deployable component for regulated industries.

splicetoday.com · Aug 26

The Chinese Technology Turning American Cars Into Weapons

Washington is investigating Chinese LiDAR hardware embedded in American vehicles, arguing for an immediate ban due to national security risks. The Chinese Communist Party has dominated global supply chains by underwriting production costs, driving down sensor prices from tens of thousands to hundreds of dollars. This strategy forces Western automakers to rely on foreign factories, creating structural vulnerabilities. LiDAR sensors generate hyper-detailed, three-dimensional maps of surroundings, including military bases, power grids, and water facilities. These devices capture exact elevations, physical entrances, and security guard patterns with precision surpassing satellite imagery. American drivers inadvertently transmit this sensitive intelligence data via cellular networks while operating vehicles. Critics warn that Beijing holds a "kill switch" over American commerce, as a sudden export halt could strand fleets and halt domestic assembly lines. The reliance on subsidized foreign technology trades long-term industrial resilience for short-term profit margins, exposing critical infrastructure to potential espionage and operational disruption by a strategic adversary.

💡 The integration of subsidized Chinese sensors into civilian vehicles transforms everyday drivers into unwitting intelligence gatherers for a geopolitical rival. This dependency creates a critical vulnerability where foreign control over essential components allows Beijing to potentially paralyze American automotive production and commerce at will.