![\"cyber](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/2023\/12\/cyber-crime.jpg\")
<\/p>\n<\/p>\n
Mandiant, a cybersecurity unit of Google, <\/span>published a report<\/span><\/a> on Thursday, September 19, exposing a covert Iranian state-sponsored cyber group known as UNC1860. The group, believed to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS), has been active in infiltrating high-priority networks across the Middle East, including government and telecommunications sectors.<\/span>\u00a0<\/span><\/p>\n The report, titled <\/span>“UNC1860 and the Temple of Oats: Iran\u2019s Hidden Hand in Middle Eastern Networks,”<\/span><\/i> outlines how UNC1860 uses a sophisticated array of tools and passive backdoors to maintain long-term access to compromised networks. Mandiant assesses that the group serves as an “initial access provider” for destructive operations carried out by other Iran-linked cyber units, echoing the methods of other known groups like Shrouded Snooper and Scarred Manticore.<\/span>\u00a0<\/span><\/p>\n While Mandiant cannot confirm UNC1860’s direct involvement in high-profile attacks such as the October 2023 wiper attack on Israel or the 2022 ROADSWEEP attacks in Albania, the report notes the group\u2019s likely contribution by providing early access to targeted networks. The group\u2019s specialized malware controllers, TEMPLEPLAY and VIROGREEN, are highlighted as key components enabling remote operators to easily access and control infected systems.<\/span>\u00a0<\/span><\/p>\n Iran\u2019s Cyber Army: A Force of Disinformation for a Cursed Causehttps:\/\/t.co\/S3LusEN4HB<\/a><\/p>\n — NCRI-FAC (@iran_policy) April 26, 2023<\/a><\/p><\/blockquote>\n\n