Uptime Hamster: 113d 11h 36mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
Logo del actor de amenaza UNC1549

UNC1549

0 incidentes 0 paises 0 sectores apt IR Ultimo: -
Aliases: asociados al grupo, oficiales para este grupo
Ver en IntelTracker → APTTrail →
UNC1549 is an Iranian state-sponsored cyber espionage group active since at least June 2022, strongly linked to Iran's Islamic Revolutionary Guard Corps (IRGC). This group is also tracked under numerous aliases including Smoke Sandstorm, Tortoiseshell, TA455, Imperial Kitten, Nimbus Manticore, Subtle Snail, GalaxyGato, Screening Serpens, and Iranian Dream Job. Their primary motivation is intelligence collection, intellectual property theft, and establishing long-term access for strategic espionage objectives. UNC1549 distinguishes itself by anticipating investigators, prioritizing long-term persistence in compromised environments, and extensively abusing trusted third-party relationships for initial access into high-value targets.

Aliases del actor

asociados al grupooficiales para este grupo

Actores similares

unc1549-crimson-sandstormactor · 1Harvesterapt · 0
Motivacion
Information theft and espionage
Tecnicas MITRE
T1078 - Valid Accounts, T1505, T1059, T1608.004, T1598.003, T1059.001
CVEs relacionadas
CVE-2025-6554, CVE-2025-55182, CVE-2025-48543, CVE-2024-4610, CVE-2023-4762, CVE-2023-41993
Tipo
apt
Pais origen
IR
Motivacion
Information theft and espionage
Impacto
38
Actualizado
Sat, 02 Ma

Sectores objetivo (OSINT)

Software PublishersAir TransportationManufacturingPublic AdministrationInternet PublishingSpace & DefenseAircraft ManufacturingReligious OrganizationsGrantmaking and Giving ServicesComputer Systems Design and Related Services