UNC1549 Critical Infrastructure Espionage Attack

This Outbreak Alert warns of active exploitation of critical on‑premises Microsoft Exchange zero‑day vulnerabilities (affecting Exchange Server 2013, 2016, 2019) and describes Iran‑linked cyber operations, including activity by UNC1549, that target aerospace, defense, and telecommunications across multiple regions. The actors use spear‑phishing, credential theft from third‑party services, and abuse of virtual desktop infrastructure (Citrix, VMware, Azure VDI) to gain initial access and move laterally; the report emphasizes patching exposed systems and monitoring for related tactics and exploitation.