Iran hacking group impersonates defense firms, hostage campaigners

Mandiant attributes an active Iranian-sponsored espionage campaign (UNC1549) to IRGC-linked operators using fake job postings and a hostage-themed website to direct victims to compromised sites that either harvest credentials or install two novel backdoors (MINIBUS, MINIBIKE); targets include aerospace, aviation and defense organizations across the Middle East and the campaign employs Azure-based infrastructure to blend with legitimate traffic.