UNC1860
UNC1860 is classified as state-sponsored.
- Malware families
- 2
- Origin
- Iran
UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). A key feature of UNC1860 is its collection of specialized tooling and passive backdoors that Mandiant believes supports several objectives, including its role as a probable initial access provider and its ability to gain persistent access to high-priority networks, such as those in the government and telecommunications space throughout the Middle East.
The group's reported origin is Iran.
The group is associated with 2 malware families.
The group is associated with 2 malware families.
Malware families
- CRYPTOSLAY
- TEMPLEDOOR
Published reports on this actor:
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.