TWOSTROKE: C++ Backdoor Used by Iranian Threat Actors

TWOSTROKE is a C++ backdoor attributed to Iranian threat actors, particularly Tortoiseshell and Nimbus Manticore. It allows system information collection, DLL loading, file manipulation, and persistence. The backdoor mimics the Windows terminal server SDK DLL (wtsapi32.dll) and uses HTTPS to communicate with C2 servers, executing commands for file operations and binary execution.