Mandiant, a cybersecurity unit of Google, published a report on Thursday, September 19, exposing a covert Iranian state-sponsored cyber group known as UNC1860. The group, believed to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS), has been active in infiltrating high-priority networks across the Middle East, including government and telecommunications sectors.
The report, titled “UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks,” outlines how UNC1860 uses a sophisticated array of tools and passive backdoors to maintain long-term access to compromised networks. Mandiant assesses that the group serves as an “initial access provider” for destructive operations carried out by other Iran-linked cyber units, echoing the methods of other known groups like Shrouded Snooper and Scarred Manticore.
While Mandiant cannot confirm UNC1860’s direct involvement in high-profile attacks such as the October 2023 wiper attack on Israel or the 2022 ROADSWEEP attacks in Albania, the report notes the group’s likely contribution by providing early access to targeted networks. The group’s specialized malware controllers, TEMPLEPLAY and VIROGREEN, are highlighted as key components enabling remote operators to easily access and control infected systems.
Iran’s Cyber Army: A Force of Disinformation for a Cursed Causehttps://t.co/S3LusEN4HB
— NCRI-FAC (@iran_policy) April 26, 2023
UNC1860’s toolkit includes advanced capabilities such as reverse engineering of Windows components, allowing them to exploit vulnerabilities while evading detection. Among its arsenal is a repurposed driver from an Iranian antivirus software, which reflects the group’s technical expertise in Windows kernel manipulation. These backdoors allow the group to stealthily monitor and control compromised systems, making it a persistent threat across the region.
The report also notes the group’s links to APT34, another Iranian cyber-espionage group. Both groups have been observed targeting entities in Iraq, Saudi Arabia, and Qatar, with UNC1860 leveraging compromised systems to scan and exploit other networks.
Mandiant’s findings emphasize the growing capabilities of Iranian cyber actors in conducting espionage and sabotage operations across the Middle East. With tensions in the region remaining high, the group’s ability to maintain prolonged access to critical networks presents a significant security threat.
