Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks

Suspected Iran-linked espionage actors have been observed deploying backdoors such as TWOSTROKE and DEEPROOT in attacks focused on aerospace, aviation and defence industries in the Middle East, according to Mandiant. The activity is attributed to a threat cluster tracked as UNC1549 (also known as Nimbus Manticore or Subtle Snail), first documented by the firm early last year.

Operating in late 2023 through 2025, UNC1549 employed initial access vectors including abuse of third-party relationships to pivot from service providers to their customers, VDI breakouts from third parties, and highly targeted phishing aimed at relevant roles. The campaign leverages both credential theft and malware delivery through trusted supplier relationships, with attackers often using Citrix, VMWare and Azure Virtual Desktop credentials harvested from external entities to establish footholds.

In addition to TWOSTROKE and DEEPROOT, the threat actor has used tools such as MINIBIKE (SlugResin), LIGHTRAIL, GHOSTLINE and others, and has been observed exploiting public programmes to query Active Directory and perform remote connections, while attempting to erase RDP history to hinder investigations.