Phishing Emails Linking to Fake Boeing/Airbus/Teledyne FLIR Career Portals (UNC1549)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•5•0•23

This rule detects potentially malicious email activity that uses recruitment or career-related pretexts to target specific organizations (Boeing, Airbus, Teledyne FLIR). The detection looks for combinations of career-themed keywords in the subject or body of an email that also contain an archive file attachment (e.g., .zip, .rar, .7z) or links, which is a common tactic for delivering malware under the guise of job applications.