Iranian State APT Blitzes Telcos & Satellite Companies

Iranian state-backed actors are behind a campaign described as some of the most bespoke cyberattacks observed, targeting 11 global telecommunications firms, satellite operators and aerospace equipment manufacturers. In the span of just a couple of weeks, Subtle Snail, a Charming Kitten subgroup also known as UNC1549, has been linked to the heists and is being tracked by cyber defenders for around four years.

The group has focussed on telecoms and satellite communications, with earlier activity noted from 2021 when it attacked a Bahrain-based IT integrator, and later activity extending to Israel, the UAE, Albania, India and Turkey; more recently, its operations are described as spreading across the Middle East, Europe and North America.

A major part of its method involves impersonation on LinkedIn as recruiters for European space firms such as Telespazio or Safran Group, followed by a modular backdoor called MiniBike that loads DLLs for additional capabilities.

The attribution notes that Subtle Snail is linked to Tortoiseshell and Charming Kitten, and emphasizes that many Iran-nexus actors work for both security companies and government customers, with the caveat that documents stolen from a telecom are often bought by the government, according to Prodaft.