UNC757

UNC757 is Mandiant's unclassified threat cluster designation for early Pioneer Kitten activity, covering Iranian-linked VPN exploitation campaigns targeting organizations in the Middle East and the United States from 2017 onward. Mandiant tracked UNC757 exploiting Pulse Secure and Fortinet vulnerabilities for initial access before the activity was more broadly characterized as part of the Pioneer Kitten/Fox Kitten cluster by other vendors. The UNC designation indicates the activity had not yet been formally merged into a named threat group at time of initial reporting.