TEMPLEDOOR
TEMPLEDOOR is a passive backdoor used by the Iranian state-sponsored threat actor UNC1860, which Mandiant assesses is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). It is part of UNC1860’s post-compromise toolchain used in persistent, stealthy intrusions against high-priority Middle Eastern networks, especially government and telecommunications organizations. UNC1860 commonly gains initial access by opportunistically exploiting vulnerable internet-facing servers, then deploying web shells and droppers such as STAYSHANTE and SASHEYAWAY; SASHEYAWAY has been reported to embed and execute TEMPLEDOOR alongside FACEFACE and SPARKLOAD. TEMPLEDOOR is described as a full passive backdoor that can execute commands, transfer files, and interact with system services. Mandiant also reported TEMPLEPLAY, a .NET-based GUI controller internally named "Client Http," as a controller for TEMPLEDOOR that supports command execution via cmd.exe, file upload/download, and HTTP proxying to facilitate RDP access to internal systems behind NAT or firewalls. The malware is associated with UNC1860’s broader use of passive implants intended to reduce reliance on classic outbound C2 and complicate network detection.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These shells enable further persistence by deploying full passive backdoors, such as TEMPLEDOOR and FACEFACE, which can execute commands, transfer files, and interact with system services.
ShroudedSnooper built a sprawling toolkit of passive backdoors and web shells — including the LionTail framework, TEMPLEDOOR, SASHEYAWAY, and a repurposed Windows kernel driver derived from Iranian antivirus software — designed to sustain long-term, low-visibility access.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Persistence
1 technique
Persistence
Web shells like STAYSHANTE and SASHEYAWAY are frequently deployed after initial access is achieved. These shells enable further persistence by deploying full passive backdoors, such as TEMPLEDOOR and FACEFACE, which can execute commands, transfer files, and interact with system services.
Command and Control
1 technique
Command and Control
UNC1860 relies on custom-made passive backdoors like TOFULOAD and WINTAPIX, which leverage undocumented Input/Output Control (IOCTL) commands for communication, bypassing standard detection mechanisms used by EDR systems. These implants operate without initiating outbound traffic, making them difficult to detect through traditional network monitoring tools.
IOCs tracked for this family
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Passive backdoor used by ShroudedSnooper for long-term low-visibility access.
Web shell/backdoor used by Iranian threat actors for persistence and remote access after exploiting VPN and firewall vulnerabilities.
A more substantial follow-on backdoor downloaded/deployed by UNC1860 after initial foothold is established.
Implant/backdoor executed via SASHEYAWAY; controlled by TEMPLEPLAY and supports command execution, file transfer, and proxying.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.