Subtle Snail: Iran-Linked Espionage Campaign Targets European Telecom, Aerospace, and Defense

Subtle Snail, an Iran-nexus cyber espionage group (UNC1549) linked to Unyielding Wasp and ultimately part of the Charming Kitten network, has pivoted to target European telecommunications, aerospace, and defence organisations. The group has been active since at least June 2022, according to Catalyst, and has infected 34 distinct devices across 11 organisations through targeted operations that leverage fake recruitment processes via LinkedIn.

The campaign begins with extensive reconnaissance, with threat actors posing as HR representatives and contacting targets with tailored job offers, and then lures victims to submit credentials through fake job portals before deploying a custom MINIBIKE backdoor variant. DLL sideloading is used to load malicious modules that perform keylogging, credential theft, screenshot capture, and Outlook credential harvesting, with all binaries signed using a certificate from Insight Digital B.V. to bypass security controls.

The attackers rely on Azure cloud-based VPS and proxy domains to disguise C2 traffic, enabling long-term exfiltration of credentials, project files, and sensitive data. 23 September 2025.