Loading story…
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets.
Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On November 18, 2025, Google-owned Mandiant publicly reported that UNC1549 had expanded and refined its operations against aerospace, aviation, and defense targets, often pivoting through third-party organizations in sectors such as technology, hospitality, and transportation. Mandiant detailed the actor's upgraded custom tooling, including DEEPROOT, TWOSTROKE, LIGHTRAIL, GHOSTLINE, POLLBLEND, CRASHPAD, DCSYNCER.SLICK, SIGHTGRAB, and TRUSTTRAP, and described stealth features such as reverse SSH tunnels, DLL hijacking, domain mimicry, and dormant backdoors.
PRODAFT previously connected the same threat actor to a recruitment-themed social engineering campaign on LinkedIn targeting European telecommunications firms. That activity reportedly led to breaches at 11 organizations, or nearly a dozen telecom firms.
Mandiant's reporting on UNC1549 was informed by incident response engagements beginning in mid-2024, during which the actor was seen using spear-phishing, stolen credentials, third-party access, and VDI or remote platform access to enter victim environments. The observed intrusions included post-exploitation actions such as reconnaissance, credential theft, lateral movement, and data theft.
Mandiant said the Iran-linked espionage cluster UNC1549, also known as Nimbus Manticore or Subtle Snail, has conducted compromises against aerospace, aviation, and defense organizations in the Middle East since late 2023. The campaign focused on espionage and long-term access, with Israel described as a central target.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iran-linked threat actor tracked as **Nimbus Manticore**—also associated in reporting with **Mirage Kitten**—has been tied to a cyber-espionage campaign targeting organizations across the Middle East, Africa, and parts of South Asia. Researchers said the operation deployed a newly documented Windows backdoor, **NightLedger**, alongside two custom WebSocket tunneling tools, **BridgeHead** and **ArcBridge**, against victims in sectors including government, telecommunications, aviation, aerospace, finance, and small and medium-sized businesses. Reported victim countries include Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso. The malware set was designed to support long-term covert access, with **NightLedger** enabling reconnaissance, command execution, file operations, process discovery, screenshot capture, exfiltration, persistence, and evasion, while **BridgeHead** and **ArcBridge** turned compromised systems into operator-controlled relays for hidden communications through victim networks. The initial intrusion vector has not been confirmed, though the actor has previously used tailored phishing lures such as fake job offers and spoofed videoconferencing pages. Researchers also published indicators of compromise, including malicious domains, an IP address, and multiple MD5 hashes to aid detection and threat hunting.
Jul 31, 2026
An Iran-linked threat group tracked as **Screening Serpens**—also known as `UNC1549`, `Smoke Sandstorm`, and `Iranian Dream Job`—ran coordinated cyberespionage operations against organizations in the United States, Israel, the United Arab Emirates, and likely two additional Middle Eastern targets. The activity, observed between February and April 2026, relied on highly tailored recruitment- and meeting-themed social engineering aimed largely at technology-sector professionals as regional tensions escalated in the Middle East. Researchers said the group deployed six new remote-access trojan variants across two malware families, **MiniUpdate** and **MiniJunk V2**, using **DLL sideloading** and Azure-hosted command-and-control infrastructure dedicated to individual targets or malware variants. A notable shift in tradecraft was the use of **AppDomainManager hijacking** in .NET applications, allowing the attackers to disable ETW and other security controls through legitimate configuration files before the host application launched. **MiniUpdate** supported command execution, DLL loading, process control, file theft, UAC elevation, and scheduled-task persistence, while **MiniJunk V2** used staged loaders, junk padding, and heavy obfuscation to hinder analysis and detection.
Jun 29, 2026
Mandiant reported that **UNC1549** targeted aerospace and defense organizations with post-compromise spear-phishing aimed at IT staff and administrators, using reconnaissance from breached inboxes and internal password-reset workflows to steal higher-privilege credentials. The group deployed several custom tools and backdoors, including **MINIBIKE**, **TWOSTROKE**, **DEEPROOT**, and the **LIGHTRAIL** tunneler, while heavily abusing **DLL search-order hijacking** against legitimate software from vendors such as Fortinet, VMware, Citrix, Microsoft, and NVIDIA. TWOSTROKE communicated over SSL on TCP/443 and supported file transfer, execution, in-memory DLL loading, and host discovery, while LIGHTRAIL used Azure-backed WebSocket infrastructure to tunnel traffic and evade detection. The activity aligns closely with earlier reporting on the Iranian-aligned **Mirage Kitten** espionage group, whose malware set included the **NightLedger** backdoor and the **ArcBridge** and **BridgeHead** tunnelers used against aerospace, aviation, defense, telecommunications, government, and financial targets across the Middle East and Africa. Securelist said NightLedger also relied on DLL hijacking by masquerading as `SspiCli.dll`, and its tunnelers provided covert WebSocket-based relay capability with enterprise proxy-aware authentication. The overlap in victimology, tradecraft, and tunneling design suggests UNC1549 is operating with a malware ecosystem strongly connected to Mirage Kitten’s previously documented toolset.
Jul 28, 2026