UNC1549 Hackers With Custom Tools Attacking Aerospace and Defense Systems to Steal Logins

The Iran-nexus cyber espionage group UNC1549 has significantly expanded its arsenal of custom tools and sophisticated attack techniques in an ongoing campaign targeting aerospace, aviation, and defense industries since mid-2024, according to new findings from Mandiant.

The threat actor, which overlaps with Tortoiseshell and has suspected links to Iran’s Islamic Revolutionary Guard Corps (IRGC), demonstrates exceptional operational security and persistence mechanisms designed to outlast victim remediation efforts.​

UNC1549 employs a dual approach to breach high-security environments.

The group combines highly targeted phishing campaigns with exploitation of trusted third-party relationships, specifically abusing Citrix, VMWare, and Azure Virtual Desktop services provided to partners and contractors.

This strategy proves particularly effective against defense contractors with mature security postures, as the threat actors circumvent primary defenses by first compromising less-protected suppliers and then pivoting to the ultimate target.​

The group’s spear-phishing operations demonstrate remarkable sophistication. Following initial breaches, UNC1549 conducts reconnaissance by reviewing compromised email accounts to identify legitimate password reset processes, then crafts convincing phishing emails specifically targeting IT staff and administrators to obtain elevated credentials.

In one notable technique, the attackers stole victim source code to create compelling spear-phishing campaigns using lookalike domains that successfully bypass proxy protections.​

Custom Malware Toolkit

The threat actor deploys an extensive suite of custom tools, with every post-exploitation payload featuring a unique hash even multiple samples of the same malware family within a single victim network.

This meticulous customization significantly complicates detection and forensic analysis.​

TWOSTROKE, a C++ backdoor, utilizes SSL-encrypted communications over TCP/443 and possesses comprehensive capabilities including system information collection, DLL loading, file manipulation, and persistence establishment.

The malware generates unique victim identifiers by XOR-encrypting the fully qualified DNS computer name with a static key.​

LIGHTRAIL, a custom tunneler based on the open-source Lastenzug project, communicates through Azure cloud infrastructure with modifications including increased maximum connections from 250 to 5,000 and hardcoded configuration parameters.

The tool employs Windows WinHTTP API for WebSocket connections with a specific User-Agent string mimicking legitimate browser traffic.​

DEEPROOT represents the group’s first observed Linux backdoor, written in Golang with cross-platform capabilities.

The malware supports shell command execution, system enumeration, and comprehensive file operations while utilizing multiple Microsoft Azure-hosted command-and-control servers for redundancy.​

GHOSTLINE and POLLBLEND serve as Windows tunnelers, with the latter using self-registration mechanisms via HTTP POST requests containing the compromised computer name.

The group signs some backdoor binaries with legitimate code-signing certificates to evade detection and bypass application allowlists, though all identified certificates have been reported for revocation.​

UNC1549’s credential theft operations showcase both technical sophistication and operational audacity. DCSYNCER.SLICK, based on open-source DCSyncer code, mimics Active Directory replication to extract NTLM password hashes directly from domain controllers.

In an unconventional tactic, the threat actors reset domain controller computer account passwords using net.exe commands, which breaks domain controller functionality and causes network outages but successfully grants directory replication rights needed for DCSync attacks.​

CRASHPAD targets saved browser credentials by decrypting configuration files through the CryptUnprotectData API while impersonating explorer.exe user privileges.

SIGHTGRAB autonomously captures screenshots at regular intervals, strategically deployed on workstations of users handling sensitive data or possessing privileged access.

The tool uses XOR encryption with a 0x41 key to decode API function names and saves timestamped screenshots to specific directories.​

TRUSTTRAP presents fake Windows prompts mimicking legitimate login windows, such as Microsoft Outlook, to trick users into submitting cleartext credentials. The group has employed this social engineering tool since at least 2023.​

Search Order Hijacking Mastery

The threat actor demonstrates a comprehensive understanding of software dependencies by exploiting DLL search-order hijacking across multiple platforms.

UNC1549 deploys malicious DLLs targeting legitimate executables from Fortigate, VMWare, Citrix, Microsoft, and NVIDIA.

In many cases, attackers install legitimate software specifically to abuse search order hijacking, while in others they replace DLLs within existing installations using SYSTEM privileges.​

For reconnaissance, UNC1549 leverages Microsoft-signed AD Explorer alongside native Windows commands and PowerShell scripts for network enumeration.

The group employs diverse lateral movement techniques including RDP, PowerShell Remoting, and notably Atelier Web Remote Commander (AWRC) a commercial agentless remote management tool requiring no pre-configuration.

AWRC enables UNC1549 to enumerate services, processes, and RDP sessions, exfiltrate browser credential files, and deploy malware.​

SCCMVNC allows exploitation of Microsoft System Center Configuration Manager’s Remote Control feature to achieve VNC-like access without user consent or notifications.

The tool reconfigures SCCM settings through WMI interactions, turning off standard consent mechanisms for stealthy remote access.​

UNC1549 extensively utilizes Microsoft Azure Web Apps and cloud infrastructure for command-and-control operations.

The group heavily relies on SSH reverse tunnels established from compromised systems to C2 servers, which limits host-based forensic artifacts since security telemetry only records network connections rather than actual data exfiltration.

The threat actors deploy redundant remote access methods including ZEROTIER and NGROK, typically activating these alternatives only after victim organizations perform remediation, demonstrating sophisticated long-term persistence planning.​

UNC1549 demonstrates increased operational security maturity over the past year. The group systematically deletes utilities post-execution and removes forensic artifacts including RDP connection history registry keys using reg delete commands.

Combined with extensive SSH reverse tunnel usage that evades EDR detection, these practices significantly hinder investigation efforts.​

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.