Loading story…
Mandiant reported that UNC1860, an Iranian state-sponsored threat actor likely tied to the Ministry of Intelligence and Security (MOIS), maintained long-term access in government and telecommunications networks across the Middle East using a broad toolset of passive backdoors, web shells, droppers, and custom controllers. The group deployed malware including TEMPLEDOOR, FACEFACE, SPARKLOAD, TEMPLEDROP, TOFUDRV, and TOFULOAD, alongside controllers such as TEMPLEPLAY and VIROGREEN, to preserve stealth and evade detection. Cisco Talos separately described a related pattern of telecom targeting in the region by ShroudedSnooper, which used the novel implants HTTPSnoop and PipeSnoop to intercept specially crafted HTTP(S) requests and named-pipe traffic while masquerading as Palo Alto Cortex XDR components.
The activity fits a broader pattern of Iranian cyber operations spanning espionage, access brokering, and destructive attacks. Mandiant said UNC1860 used compromised environments to scan and exploit additional regional targets, including entities in Saudi Arabia and Qatar, and identified overlaps with APT34 and other MOIS-linked clusters. Check Point and Microsoft have also documented Iranian operations tied to telecom surveillance, attacks on the Albanian government, destructive activity in Israel, and cyber-enabled support operations aligned with Hamas, reinforcing assessments that Tehran-linked actors are using covert implants, telecom access, and regional footholds to support both intelligence collection and disruptive campaigns.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Mandiant reported that UNC1860 is a persistent Iranian state-sponsored actor likely affiliated with MOIS and active against government and telecommunications networks across the Middle East. The report also said UNC1860 likely acts as an initial access provider and linked its tooling to the March 2024 wiper activity targeting Israeli organizations.
Check Point published research on Void Manticore's destructive operations in Israel, adding public reporting on the March 2024 Israel-focused activity.
In March 2024, the Israeli National Cyber Directorate was alerted to wiper activity targeting Israeli entities across managed service providers, local governments, and academia. Mandiant later linked technical indicators from this activity, including STAYSHANTE and SASHEYAWAY, to UNC1860 tooling.
Check Point published research on Scarred Manticore operations spanning Albania to the Middle East, adding public reporting on the actor's regional surveillance activity.
Cisco Talos publicly identified the new intrusion set ShroudedSnooper and disclosed the HTTPSnoop and PipeSnoop implants used against Middle Eastern telecom providers. Talos also shared findings with Microsoft and Palo Alto Networks.
Talos reported that the HTTPSnoop implant was first crafted on April 17, 2023, with later variants appearing on April 19 and April 29. The malware listens for specific HTTP(S) URLs and executes received shellcode.
Microsoft investigated Iranian cyberattacks against the Albanian government, an operation later tied to the broader actor cluster discussed in subsequent reporting on Scarred Manticore and related activity.
Cisco Talos said the ShroudedSnooper intrusion set targeted telecommunications providers in the Middle East with the HTTPSnoop and PipeSnoop implants. Talos said the activity likely occurred between August 2022 and April 2023 based on the masqueraded software versioning.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourceresearch.checkpoint.com
Open sourceresearch.checkpoint.com
Open sourceblog.talosintelligence.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
Check Point Research reported that **Iranian Ministry of Intelligence and Security (MOIS)-linked actors** are increasingly moving beyond simply *posing* as cybercriminals and are instead **directly engaging with the cybercrime ecosystem**—using criminal tooling, services, and operational models to support state objectives while complicating attribution. The activity is highlighted in operations tied to **Void Manticore** (including the *Handala Hack* persona) and **MuddyWater**, where researchers observed repeated overlaps with criminal tools and infrastructure, suggesting an affiliate-style or service-consumption model that improves resilience and capability. Reporting on the research noted that **Void Manticore** has incorporated the commercially sold infostealer **Rhadamanthys** (marketed on cybercrime forums) into campaigns, including phishing activity targeting Israeli entities; the infostealer has been paired with custom wipers and lure themes such as impersonated **F5 updates** and even messages spoofing the **Israeli National Cyber Directorate (INCD)**. The same coverage reiterated that **MuddyWater** continues MOIS-aligned espionage activity and is also associated with cybercrime-style tooling and services, reinforcing the assessment that Iranian state operators are increasingly blending state tradecraft with criminal malware, infrastructure, and monetized services rather than relying solely on false-flag “ransomware” or hacktivist branding.
Jun 29, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026