UNC1549
Iranian state-sponsored (IRGC-linked) · Espionage / intelligence collection / aerospace and defence intelligence
Tactics, Techniques & Procedures (TTPs)
- Career-themed spear-phishing with fake job offers from defence industry personas ("Iranian Dream Job" methodology)
- MiniFast backdoor — LLM-assisted rapid development enabling fast malware iteration
- AppDomain Hijacking for stealthy .NET code injection: replaces legacy DLL sideloading, executes before EDR initialises
- SEO poisoning for malware delivery — trojanised legitimate software installers (Oracle SQL Developer lure documented)
- DLL sideloading alongside legitimate signed executables (legacy delivery, still observed)
- Credential collection, file staging, and persistent remote command execution via backdoor
- Azure-hosted C2 infrastructure with dedicated per-target domain clusters
- Personalised spear-phishing themed around aerospace and defence job listings ("Iranian Dream Job" approach)
- MiniUpdate and MiniJunk V2 RAT families — six new variants documented in 2026
- AppDomainManager hijacking for EDR bypass: malicious .NET assembly loaded during application startup before endpoint tooling hooks
- Azure-hosted C2 infrastructure — dedicated domain clusters per intrusion set to prevent cross-contamination
- DLL sideloading alongside legitimate signed executables for payload delivery
- Operational tempo surge timed to regional conflict escalation (from February 2026)
- Career-themed spear-phishing with fake job offers from defence industry personas
- MiniFast backdoor (LLM-assisted development -- rapid iteration capability)
- AppDomain Hijacking for stealthy .NET code injection (replaces DLL sideloading)
- SEO poisoning for malware delivery -- trojanised software installers (Oracle SQL Developer lure)
- DLL sideloading alongside legitimate signed executables (legacy delivery)
- Credential collection, file staging, and command execution via backdoor
Known Targets
Analyst Notes
Mandiant tracking designation UNC1549, corresponding to Palo Alto Unit 42's Screening Serpens and the Nimbus Manticore designation used in other published research. Assessed as IRGC-linked based on targeting priorities and operational patterns. Historically focused on aerospace and defence intelligence across Israel, the Gulf states, and Turkey. Following the US-Iran regional conflict escalation beginning 28 February 2026 (Operation Epic Fury), the group dramatically increased operational tempo: new backdoor family (MiniFast), two new delivery techniques (AppDomain Hijacking, SEO poisoning), and significantly expanded European targeting within a three-month window. The SEO poisoning delivery channel is particularly significant — it bypasses email security controls entirely, requiring no prior contact with the target. LLM-assisted malware development (MiniFast) indicates adaptation of commercial AI tools to accelerate retooling under operational pressure. Additional reporting: Iran-nexus APT tracked by Palo Alto Networks Unit 42 as Screening Serpens and by Mandiant as UNC1549; shares infrastructure and tradecraft with Smoke Sandstorm. Unit 42 documented six new RAT variants (MiniUpdate, MiniJunk V2 families) deployed in a campaign wave between February and April 2026 — directly correlated with the escalation of regional conflict from 28 February 2026. The AppDomainManager hijacking technique is specifically engineered to execute before EDR products initialise their hooks, making it effective against organisations with modern endpoint security tooling. Spear-phishing lures impersonating a major commercial airline and defence sector employers demonstrate investment in personalised social engineering at scale. See also: UNC1549 (Screening Serpens / Nimbus Manticore) profile. Additional reporting: Tracked by Mandiant as UNC1549, linked to IRGC intelligence collection operations. Historically focused on aerospace and defence across Israel, the Gulf states, and Turkey. Following the US-Iran conflict that began February 2026 (Operation Epic Fury), the group dramatically accelerated its tempo: new backdoor (MiniFast), two new delivery techniques, and significantly expanded European targeting within a three-month window. The SEO poisoning delivery channel bypasses email security controls entirely -- no prior contact with targets required. The pace of retooling indicates direction to collect rapidly while the conflict window is open.
Also Known As
MITRE ATT&CK Techniques
Intelligence Reports
Screening Serpens Expands Arsenal With Six New RAT Variants in Aerospace, Defence, and Telecom Espionage Campaign
Palo Alto Networks Unit 42 has published new research detailing how Iran-nexus APT Screening Serpens deployed six previously undocumented RAT variants against US, Israeli, and UAE targets in aerospace, defence manufacturing, and telecommunications between February and April 2026.
UNC1549: Iran's Persistent Aerospace and Defence Espionage Operation
UNC1549 — tracked as Screening Serpens and Nimbus Manticore by different intelligence vendors — is an IRGC-affiliated Iranian APT conducting sustained espionage against aerospace, defence, and telecommunications targets. Their recent expansion to European targeting, adoption of Azure and cloud C2 infrastructure, and novel AppDomainManager injection technique make them a growing concern beyond their traditional Middle East focus.
Nimbus Manticore Resurfaces with New Backdoor and Expanded European Targeting After Operation Epic Fury
Iranian IRGC-affiliated APT Nimbus Manticore has resumed aggressive campaigns against aviation, telecommunications, and critical infrastructure in Europe and the US, deploying an undocumented AI-assisted backdoor and adopting new delivery techniques since the outbreak of the US-Iran conflict.