UNC1549

UNC1549 is Mandiant's designation for a suspected IRGC-linked Iranian espionage cluster active since at least June 2022, also tracked as Smoke Sandstorm (Microsoft) and overlapping with Imperial Kitten and Tortoiseshell. The group targets aerospace, aviation, and defense organizations primarily in Israel and the UAE, with expanded operations documented into the United States, Qatar, Spain, Saudi Arabia, Turkey, India, and Albania. UNC1549 uses highly customized spear-phishing campaigns with job-themed lures — including fake career portals impersonating Boeing, Airbus, and defense firms — to deliver the MINIBIKE and MINIBUS backdoors, which abuse Microsoft Azure cloud infrastructure for command and control. Since mid-2024, the group has also exploited trusted third-party and supply-chain access to reach high-security targets. Collected intelligence including emails, network documentation, and intellectual property on propulsion, radar, and precision guidance systems directly supports Iranian missile and drone program development and strategic procurement objectives. Check Point tracks the same cluster as Nimbus Manticore.