UNC1860

UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). A key feature of UNC1860 is its collection of specialized tooling and passive backdoors that Mandiant believes supports several objectives, including its role as a probable initial access provider and its ability to gain persistent access to high-priority networks, such as those in the government and telecommunications space throughout the Middle East.

Grubun kökeni İran olarak bildiriliyor.

Grup 2 zararlı yazılım ailesiyle ilişkilendirildi.

Grup 2 zararlı yazılım ailesiyle ilişkilendirildi.

Bu aktör hakkında yayımlanmış raporlar:

• https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks

Kaynak: MISP Galaxy, Malpedia.