Actors Insights|Latest update04/07/2026

UNC1860

Named by MandiantSuspected state sponsor: Islamic Republic of Iran

UNC1860 is Mandiant's designation for the Iranian MOIS-linked threat cluster known as Scarred Manticore. Mandiant's 2024 reporting on UNC1860 documented the group's role as a specialized initial access provider — gaining footholds in target networks and then handing access to other Iranian state actors for follow-on espionage or destructive operations. Mandiant assessed UNC1860 has provided access to MOIS-linked destructive operators in high-profile attacks against Middle Eastern government and telecommunications targets, positioning the group as a critical enabler within Iran's broader cyber offensive ecosystem. The group's passive IIS-based implant framework makes its presence particularly difficult to detect and remediate.

First Seen:Jan 2019
Last Seen:Sep 2024
Indexed Reports:1
Public IOCs:65
Cluster: Scarred ManticoreMisp: UNC1860
also known as:
UNC1860 (Mandiant)

Targeted Regions

Albania
AL
Albania
Albania
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Israel
IL
Israel
Israel
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Middle East
ME
Middle East
Middle East
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Qatar
QA
Qatar
Qatar
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019Sep 2026

Targeted Sectors

Government Agencies and ServicesTelecommunication

Recent Indexed Reports

  1. Public
    UNC1860 Targets Middle Eastern Networks with Specialized Tooling

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.