UNC1549 Critical Infrastructure Espionage Attack

Suspected Iran-linked APT UNC1549 is conducting targeted espionage against high-value aerospace, defense, and telecom organizations using tailored spear-phishing, credential theft, abuse of VDI (Citrix/VMware/Azure VDI), exploitation of Exchange-related vulnerabilities (CVE-2021-26855, CVE-2020-0688), and multiple custom malware/tools (MINIBIKE, TWOSTROKE, DEEPROOT, LIGHTRAIL, GHOSTLINE) to establish long-term persistence and exfiltrate sensitive technical data; FortiGuard and other vendors provide detections and mitigations and public reporting from Mandiant, Google, and FortiGuard is cited.