Loading story…
Mandiant reported that UNC1549 targeted aerospace and defense organizations with post-compromise spear-phishing aimed at IT staff and administrators, using reconnaissance from breached inboxes and internal password-reset workflows to steal higher-privilege credentials. The group deployed several custom tools and backdoors, including MINIBIKE, TWOSTROKE, DEEPROOT, and the LIGHTRAIL tunneler, while heavily abusing DLL search-order hijacking against legitimate software from vendors such as Fortinet, VMware, Citrix, Microsoft, and NVIDIA. TWOSTROKE communicated over SSL on TCP/443 and supported file transfer, execution, in-memory DLL loading, and host discovery, while LIGHTRAIL used Azure-backed WebSocket infrastructure to tunnel traffic and evade detection.
The activity aligns closely with earlier reporting on the Iranian-aligned Mirage Kitten espionage group, whose malware set included the NightLedger backdoor and the ArcBridge and BridgeHead tunnelers used against aerospace, aviation, defense, telecommunications, government, and financial targets across the Middle East and Africa. Securelist said NightLedger also relied on DLL hijacking by masquerading as SspiCli.dll, and its tunnelers provided covert WebSocket-based relay capability with enterprise proxy-aware authentication. The overlap in victimology, tradecraft, and tunneling design suggests UNC1549 is operating with a malware ecosystem strongly connected to Mirage Kitten’s previously documented toolset.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Mandiant reported that UNC1549 targeted the aerospace and defense ecosystem using spear-phishing against IT staff and administrators after initial breaches to obtain higher-privilege credentials. The report detailed custom tools and malware including MINIBIKE, TWOSTROKE, DEEPROOT, and the LIGHTRAIL tunneler, as well as extensive DLL search order hijacking and uniquely hashed payloads to hinder detection and forensics.
Securelist reported a Mirage Kitten cyber-espionage campaign and attributed a previously undocumented malware set to the Iranian-aligned group, including the NightLedger backdoor and the ArcBridge and BridgeHead tunnelers. The activity targeted organizations in sectors including aerospace, aviation, defense, telecommunications, government, SMB, and finance across the Middle East and Africa.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecloud.google.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
An Iran-linked threat actor tracked as **Nimbus Manticore**—also associated in reporting with **Mirage Kitten**—has been tied to a cyber-espionage campaign targeting organizations across the Middle East, Africa, and parts of South Asia. Researchers said the operation deployed a newly documented Windows backdoor, **NightLedger**, alongside two custom WebSocket tunneling tools, **BridgeHead** and **ArcBridge**, against victims in sectors including government, telecommunications, aviation, aerospace, finance, and small and medium-sized businesses. Reported victim countries include Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso. The malware set was designed to support long-term covert access, with **NightLedger** enabling reconnaissance, command execution, file operations, process discovery, screenshot capture, exfiltration, persistence, and evasion, while **BridgeHead** and **ArcBridge** turned compromised systems into operator-controlled relays for hidden communications through victim networks. The initial intrusion vector has not been confirmed, though the actor has previously used tailored phishing lures such as fake job offers and spoofed videoconferencing pages. Researchers also published indicators of compromise, including malicious domains, an IP address, and multiple MD5 hashes to aid detection and threat hunting.
Jul 31, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026