UNC1549 Iranian APT Targeting Aerospace and Defense

UNC1549 (also known as Nimbus Manticore or Smoke Sandstorm) is an Iranian-linked cyber-espionage group active since at least June 2022. The group primarily targets aerospace, aviation, and defense organizations across the Middle East, South Asia, and Western Europe. Their campaigns frequently utilize social engineering through fake React-based recruitment portals mimicking major industry players like Boeing and Airbus to lure victims into downloading malicious payloads.

Technically, the group employs a sophisticated multi-stage infection chain involving custom backdoors, credential stealers, and screenshot utilities. They utilize advanced evasion techniques such as binary padding and compiler-level obfuscation to bypass security controls. Recent strategic shifts show the group expanding its operational footprint into Western European nations including Portugal, Sweden, and Denmark as of late 2025.

This activity represents a significant threat to the global defense supply chain, focusing on high-value intelligence gathering and credential harvesting that can lead to long-term persistent access and lateral movement within sensitive networks.