UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware

An Iran-nexus cyber espionage group known as UNC1549 has been attributed to a new campaign targeting European telecommunications firms, infiltrating 34 devices across 11 organisations. PRODAFT tracks the cluster under the name Subtle Snail and assesses it as affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC); the 11 target companies are located in Canada, France, the United Arab Emirates, the United Kingdom, and the United States.

Attacks unfold through LinkedIn-based recruitment lures, where the group poses as HR representatives to engage target employees before deploying a MINIBIKE backdoor variant that communicates with command-and-control infrastructure proxied through Azure cloud services to bypass detection, according to PRODAFT. MINIBIKE is a modular backdoor with 12 commands for C2, capable of gathering system information, keystrokes logging, browser data theft, and screen capture, with DLL side-loading used to subvert detection.

The operation also involves long-term persistence and data exfiltration, with the group tailoring a victim-specific DLL for each machine and using legitimate DLL exports to help conceal activity, PRODAFT noted. MuddyWater, another Iranian group, is also discussed in context of diversified tooling and infrastructure.