Tortoiseshell, also known as Imperial Kitten and Unyielding Wasp, is an Iranian threat actor active since at least July 2018. It targets defense, aerospace, IT service providers, and military organizations in the Middle East and the U.S. Recent infrastructure discoveries indicate an expanded targeting profile including European countries. The group is linked to Nimbus Manticore and uses custom tools like TWOSTROKE backdoor and SSH tunnelers.