UNC788

UNC788 is Mandiant's unclassified threat cluster designation for an Iranian-linked group focused on mobile surveillance operations targeting Iranian and diaspora individuals. The group is known for operating fake Android applications designed to harvest sensitive data from targeted individuals, consistent with Iran's domestic surveillance mission. UNC788 activity includes credential theft, contact harvesting, and location tracking of opposition figures and Iranian minority communities. Mandiant's UNC designation indicates attribution confidence had not yet reached the threshold for formal classification into a named group at time of reporting. MITRE ATT&CK also tracks this cluster under the identifier G1029.