Loading malware…
TWOSTROKE is a custom C++ Windows backdoor associated with the Iranian espionage actor tracked as UNC1549, Mirage Kitten, Nimbus Manticore, and Smoke Sandstorm. It has been used in long-term intrusions against aerospace, aviation, defense, telecommunications, and related organizations, particularly in the Middle East, as part of broader espionage operations focused on persistence and sustained post-compromise access.
The malware provides remote backdoor functionality including system information collection, file manipulation, in-memory or runtime DLL loading, and persistence. Reporting also characterizes it as enabling remote system control. TWOSTROKE communicates with command-and-control infrastructure over SSL-encrypted TCP on port 443 and uses a custom-delimited tasking format. It derives a victim identifier from the host’s fully qualified DNS computer name through simple transformation logic before interacting with its controllers.
TWOSTROKE has been deployed post-compromise alongside other UNC1549 tooling such as MINIBIKE, DEEPROOT, LIGHTRAIL, GHOSTLINE, POLLBLEND, CRASHPAD, DCSYNCER.SLICK, SIGHTGRAB, and TRUSTTRAP. The actor commonly uses DLL search-order hijacking to execute its malware, sometimes by abusing legitimate software from enterprise vendors or installing legitimate software specifically to facilitate sideloading. Across campaigns, UNC1549 has relied on spearphishing, including recruitment- and job-themed lures, as well as stolen credentials and third-party access to reach target environments. TWOSTROKE forms part of this actor’s bespoke persistence toolkit and reflects an emphasis on stealth, tailored deployment, and durable access for intelligence collection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware communicates using custom-delimited C2 responses, demonstrating continued reuse and refinement of techniques previously observed in the group's TWOSTROKE backdoor.
The malware is designed to contact an external server over HTTPS to parse and run commands in a manner that's analogous to TWOSTROKE, another backdoor deployed by the threat actor in the past.
"TWOSTROKE, a C++ backdoor that allows for system information collection, DLL loading, file manipulation, and persistence"
Iranian groups deploy MINIBIKE, TWOSTROKE, DEEPROOT, and CRASHPAD in Dream Job-style campaigns...
2 distinct techniques documented for this family, organized by ATT&CK tactic.
"UNC1549 abused DLL search order hijacking to execute CRASHPAD, DCSYNCER.SLICK, GHOSTLINE, LIGHTRAIL, MINIBIKE, POLLBLEND, SIGHTGRAB, and TWOSTROKE payloads... installed the legitimate software after initial access in order to abuse SOH... replaced or added the malicious DLLs within the legitimate installation directory, typically with SYSTEM privileges."
"UNC1549 abused DLL search order hijacking to execute CRASHPAD, DCSYNCER.SLICK, GHOSTLINE, LIGHTRAIL, MINIBIKE, POLLBLEND, SIGHTGRAB, and TWOSTROKE payloads... installed the legitimate software after initial access in order to abuse SOH... replaced or added the malicious DLLs within the legitimate installation directory, typically with SYSTEM privileges."
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A historical Mirage Kitten backdoor referenced for code or behavioral similarity with NightLedger's C2 communication techniques.
A backdoor previously deployed by the same threat actor and referenced here as functionally analogous to NightLedger.
A previously documented backdoor attributed to the same APT, referenced here because NightLedger shares code and C2 response formatting similarities with it.
Backdoor previously deployed by Nimbus Manticore in attacks against aviation and defense organizations across the Middle East.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.