1. Home
  2. Software
  3. TWOSTROKE

TWOSTROKE

TWOSTROKE is malicious backdoor written in C++ that is capable of discovery actions, executing payloads and exfiltrating data.[1] TWOSTROKE was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9067
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 01 October 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

TWOSTROKE can execute shell commands.[1]
Enterprise T1132 .001 Data Encoding: Standard Encoding

TWOSTROKE has encoded its payloads with hex and separates values with @##@.[1]
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

TWOSTROKE has utilized SSL encrypted C2 over TCP port 443.[1]
Enterprise T1041 Exfiltration Over C2 Channel

TWOSTROKE can exfiltrate data over C2.[1]
Enterprise T1083 File and Directory Discovery

TWOSTROKE has the ability list the directory.[1]
Enterprise T1574 .001 Hijack Execution Flow: DLL

TWOSTROKE has been deployed using DLL search order hijacking.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

TWOSTROKE has the ability to delete files.[1]
Enterprise T1105 Ingress Tool Transfer

TWOSTROKE has downloaded files from C2.[1]
Enterprise T1106 Native API

TWOSTROKE has leveraged Windows API calls to gather system information using GetComputerNameExW(ComputerNameDnsFullyQualified).[1]
Enterprise T1027 .013 Obfuscated Files or Information: Encrypted/Encoded File

TWOSTROKE has encrypted gathered device data with XOR and a static key.[1]
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

TWOSTROKE has utilized valid digital signatures to evade detection from security tools.[1]
Enterprise T1082 System Information Discovery

TWOSTROKE has gathered victim hostname and the domain through GetComputerNameExW(ComputerNameDnsFullyQualified).[1]
Enterprise T1033 System Owner/User Discovery

TWOSTROKE has gathered the full victim name.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

TWOSTROKE has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.