Tortoiseshell's 'uk1' and 'uk2': Iranian espionage crew now has servers in Britain

A server labelled uk1 is a naming convention, not a victim list. Group-IB's own report says the purpose of the infrastructure is unclear and that country-themed server names are not enough to establish whom Tortoiseshell was aiming at ^[11]. What the material supports is a scoping change rather than an incident: a group whose espionage has run mainly against defense, aerospace, technology and military organisations in the Middle East and the United States ^[5] now has machines answering on British IP addresses ^[7], with further infrastructure reported in Belgium, Saudi Arabia and the UAE ^[9].

For anyone writing detections, the tooling is the more useful half of the report. Group-IB identified a tool that opens a reverse SSH tunnel between infected machines and attacker-controlled infrastructure ^[3]. The connection starts inside the network and is encrypted, which lets the operator route traffic back through the compromised host to reach other systems while sidestepping controls designed to block incoming connections ^[4]. A perimeter tuned against inbound traffic does no work against that. The signal lives in outbound behaviour on hosts that have no reason to hold long-lived SSH sessions.

The backdoor is continuity, not novelty. Google's threat intelligence researchers documented TwoStroke in late 2025 ^[12], and Group-IB says its newly found sample resembles that tool and shows the group still using it ^[2]. On an infected machine it supports command execution, file download and theft, directory inspection and collection of host details ^[13].

Duration is worth stating plainly. Tortoiseshell has been active since at least 2018 ^[5] and Group-IB describes it as one of the most active Iranian APT groups operating in 2026 ^[8], which is at least eight years of continuous operations ^[14]. Researchers have previously tied the group to work supporting Iran's Islamic Revolutionary Guard Corps ^[6]. A crew with that history does not stand up UK-labelled hosts on a whim, but neither does it need a UK victim to justify them; staging, relaying and redirection all look identical from the outside. Group-IB's reading is that infrastructure and tooling together point to wider geographic reach and greater capability ^[10]. That is the vendor's inference, and it currently rests on infrastructure that has not been connected publicly to any named target ^[11].