OATBOAT
OATBOAT is a loader/backdoor associated with the Iranian state-sponsored threat actor UNC1860, which Mandiant assesses is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). It is described as a loader that loads and executes shellcode payloads, including TOFULOAD and TOFUPIPE, and has been referred to as a main-stage implant/backdoor used against high-value targets. The related payloads TOFULOAD and TOFUPIPE are described as TCP-based passive listeners, and broader UNC1860 reporting emphasizes the group’s use of passive implants that avoid initiating outbound traffic, complicating network detection. OATBOAT appears in intrusion chains following exploitation of vulnerable internet-facing systems and deployment of web shells or droppers used by UNC1860. The actor has targeted high-priority networks in the Middle East, especially government and telecommunications organizations, with additional reporting also citing media, academia, and critical infrastructure. Mentioned OATBOAT samples include variants masquerading as CyveraConsole.exe, cct.exe, systemre.exe, and wlbsctrl.dll, including samples containing encrypted TOFULOAD shellcode or payloads such as TOFUPIPE. High-confidence associations in the provided content tie OATBOAT to UNC1860’s stealth-focused tooling ecosystem alongside TEMPLEDOOR, TEMPLEDROP, SASHEYAWAY, TOFULOAD, WINTAPIX, and related utilities.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OATBOAT ... CyveraConsole.exe_OATBOAT that contains encrypted shellcode of TOFULOAD ... OATBOAT with TOFULOAD shellcode
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A main-stage backdoor/loader that loads and executes additional payloads (including passive TCP listeners) and leverages stealthy techniques (e.g., undocumented HTTP.sys functionality) to evade detection.
Loader used to load and execute shellcode payloads.
A loader/staging component used to carry or load encrypted TOFULOAD or TOFUPIPE shellcode.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.