Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace

Researchers say an Iran-nexus threat actor known as UNC1549 has been targeting organisations in the aerospace sector, with activity focused on aerospace and defense entities in the US, the UAE, Qatar, Spain, and Saudi Arabia. Researchers for Google Cloud's Mandiant said as much in a November 17 blog post dedicated to UNC1549, noting that Israel remains a central focus but that the actor’s scope has broadened to include more organisations in the US, the UAE, Qatar, Spain and Saudi Arabia.

The report also states that UNC1549 overlaps with an IRGC-linked group known as Tortoiseshell, according to earlier reporting by Dark Reading. Mandiant’s analysis describes tactics and techniques observed since mid-2024, including spear-phishing, third-party compromise, and post-exploitation methods such as stealing source code to aid future campaigns.

Analysts from CrowdStrike and ESET are cited, with CrowdStrike referring to the actor as Imperial Kitten and ESET noting GalaxyGato as other names used to describe the same threat. The blog highlights custom tooling, backdoors, and techniques to evade detection, including SSH reverse tunnels and the abuse of trusted relationships with suppliers to pivot into primary targets.