UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks

Written by: Stav Shulman, Matan Mimran, Sarah Bock, Mark Lechtik

div class=”block-paragraph_advanced”>

Executive Summary

UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). A key feature of UNC1860 is its collection of specialized tooling and passive backdoors that Mandiant believes supports several objectives, including its role as a probable initial access provider and its ability to gain persistent access to high-priority networks, such as those in the government and telecommunications space throughout the Middle East.

UNC1860’s tradecraft and targeting parallels with Shrouded Snooper, Scarred Manticore, and Storm–0861, Iran-based threat actors publicly reported to have targeted the telecommunications and government sectors in the Middle East. These groups have also reportedly p

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.