TWOSTROKE

TWOSTROKE is malicious backdoor written in C++ that is capable of discovery actions, executing payloads and exfiltrating data. TWOSTROKE was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.

View graph Watch Export

Indicators tracked

Intelligence Reports1

1 intelligence report available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

21 relationships

T1033: System Owner/User Discovery

source

T1132.001: Standard Encoding

source

T1027.013: Encrypted/Encoded File

source

T1574.001: DLL

source

T1553.002: Code Signing

source

T1082: System Information Discovery

source

T1106: Native API

source

T1083: File and Directory Discovery

source

T1041: Exfiltration Over C2 Channel

source

T1573.002: Asymmetric Cryptography

source

T1059.003: Windows Command Shell

source

T1070.004: File Deletion

source

T1105: Ingress Tool Transfer

source