Iranian APT UNC1549 Infiltrates Aerospace by Hijacking Trusted DLLs and Executing VDI Breakouts

According to Mandiant, the threat group UNC1549, suspected to be linked to Iran, has broadened its cyber-espionage operations across the aerospace, aviation, and defence sectors since mid-2024. The group employs a dual intrusion strategy, compromising trusted third-party suppliers and contractors while launching highly personalised spear-phishing campaigns to gain initial access.

After authentication, UNC1549 is observed moving laterally via VDI breakouts and abusing enterprise virtualization tools such as Citrix, VMware and Azure Virtual Desktop, using stolen third-party credentials to access targets. Mandiant notes a wide arsenal of custom payloads for persistence and reconnaissance, including MINIBIKE, TWOSTROKE, DEEPROOT, POLLBLEND, CRASHPAD, SIGHTGRAB, DCSYNCER[.]SLICK and LIGHTRAIL, with each sample having a unique hash across victims.

The group also relies on DLL search order hijacking to execute payloads and has installed legitimate software packages to hijack DLL load paths, while LightRail has been enhanced with a higher maximum connection count and Azure-based WebSocket C2. On Linux, UNC1549 deployed DEEPROOT, a Golang backdoor supporting shell execution and multi-server C2 fallback.