Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace

Mandiant (Google Cloud) researchers report that UNC1549, an Iran-nexus espionage actor linked to IRGC interests, has conducted sustained campaigns since mid-2024 against aerospace, aviation, and defense sectors — often leveraging spear-phishing and compromised third-party suppliers to pivot into high-value targets; the actor uses custom backdoors and tools (Twostroke, Lightrail, Deeproot, DCSyncer.Slick), SSH reverse tunnels, and techniques to evade forensics and exfiltrate sensitive IP, emails, and network documentation, with activity expanding geographically to include the US, UAE, Qatar, Spain, Saudi Arabia, Israel, and Greece.