Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2021-26855 | 9.8 | 100.0% | ✅ listed | available | 89.78 (Critical) |
| CVE-2020-0688 | 8.8 | 100.0% | ✅ listed | available | 87.0 (Critical) |
UNC1549 Targets Aerospace, Defense, and Telecom in Europe
FortiGuard Labs has released an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group actively targeting aerospace, defense, and telecommunications organizations across Europe and other regions. The campaign has been running since mid-2024 against high-value targets.
The attack chain begins with tailored spear-phishing for credential theft, followed by abuse of virtual desktop infrastructure (Citrix, VMware, or Azure VDI) for initial access and lateral movement within target networks. UNC1549 has previously leveraged CVE-2021-26855 (Microsoft Exchange Server RCE, CVSS 9.8, EPSS 100%, KEV) and CVE-2020-0688 (Microsoft Exchange Memory Corruption, CVSS 8.8, EPSS 100%, KEV) to gain initial access and facilitate follow-on exploitation.
The group deploys five custom malware families: DEEPROOT, GHOSTLINE, LIGHTRAIL, MINIBIKE, and TWOSTROKE. MINIBIKE provides a modular backdoor for credential theft, keylogging, and screenshot capture. The toolset supports long-term persistence and evasion across the campaign.
How the Attack Works: Phishing, Credential Theft, and VDI Abuse
The campaign opens with a tailored spear-phishing email designed to steal credentials from a third-party application. Once the victim authenticates, UNC1549 pivots through virtual desktop infrastructure—Citrix, VMware, or Azure VDI—to reach the target’s internal network. This VDI layer serves as the primary lateral movement and persistence mechanism, allowing the group to jump into downstream environments without direct exposure to the initial phishing target.
Supply-chain relationships extend the reach: UNC1549 uses the VDI foothold to pivot into downstream target environments, giving it a path into deeper infrastructure without re-phishing each tier.
For initial access and follow-on exploitation, the group has previously deployed two Microsoft Exchange Server vulnerabilities. CVE-2021-26855 is a remote code execution flaw scoring CVSS 9.8 (v3.1) with an EPSS score of 100.0% and a KEV listing. CVE-2020-0688 is a memory corruption RCE in Exchange, rated CVSS 8.8 (v3.1), also at EPSS 100.0% and KEV. Both have public PoCs and carry PRS risk scores of 89.78 and 87.0 respectively, placing them in the Critical band.
The Exchange RCEs: CVE-2021-26855 and CVE-2020-0688
UNC1549 has previously exploited two Microsoft Exchange Server vulnerabilities to gain initial access into target networks. CVE-2021-26855 is a remote code execution flaw in Exchange Server rated CVSS 9.8 (v3.1) with an EPSS score of 100.0% and a CISA KEV listing. It carries a PRS risk score of 89.78, placing it in the Critical band. A public PoC is available.
CVE-2020-0688 is a memory corruption RCE in Exchange, rated CVSS 8.8 (v3.1), also at EPSS 100.0% and KEV. Its PRS risk score is 87.0, also Critical. Both CVEs have public PoCs and have been exploited in the wild by UNC1549 for initial access and follow-on exploitation.
FortiGuard had already flagged these Exchange RCEs in a March 2021 Outbreak Alert, noting they had been exploited in the wild by UNC1549 to gain initial access into target networks.
Five Custom Malware Families: DEEPROOT, GHOSTLINE, LIGHTRAIL, MINIBIKE, TWOSTROKE
MINIBIKE is the workhorse: a modular backdoor that handles credential theft, keylogging, screenshot capture, and deployment of follow-on payloads. It runs as a single implant dropped into the target environment and gives the operator a full interactive shell for post-exploitation.
DEEPROOT, GHOSTLINE, LIGHTRAIL, and TWOSTROKE round out the custom toolset. DEEPROOT and GHOSTLINE provide persistence and evasion primitives; LIGHTRAIL handles lateral movement and privilege escalation; TWOSTROKE is a second backdoor variant that Group-IB pulled from APT hunting and that mirrors the reverse SSH tunnel pattern Google Cloud documented for UNC1549.
Nextron Systems identified a .NET stager that uses AppDomain Hijacking to drop the agent implant and persist it via a scheduled task. The agent implant carries data exfiltration and remote control capabilities, with C2 over an Azure base domain and a reverse SSH tunnel back to localhost:1081 on the C2 server. That tunnel is what forwards traffic from the C2 server directly into the compromised network, matching the TTPs Google Cloud previously published for UNC1549.
Who Is UNC1549: Iran-Nexus APT with Multiple Aliases
UNC1549 is a suspected Iran-nexus APT group tracked under multiple aliases: Nimbus Manticore, Smoke Sandstorm, and Mirage Kitten. Group-IB attributes the group to the Islamic Revolutionary Guard Corps (IRGC), placing it within the broader Iranian APT ecosystem. The group has been active since mid-2024, executing targeted espionage campaigns against aerospace, aviation, and defense organizations across the Middle East and Europe.
Mandiant first reported the activity in February 2024, identifying UNC1549 as a suspected Iranian actor targeting aerospace, aviation, and defense sectors in Israel, the United Arab Emirates, and potentially Turkey, India, and Albania. The group gained initial access through tailored spear-phishing and leveraged two Microsoft Exchange Server RCEs for follow-on exploitation.
Google Cloud published a Frontline Intelligence analysis in November 2025 covering the group's TTPs, custom tooling, and malware. The analysis documents the full operational chain: a .NET stager using AppDomain Hijacking to drop the agent implant, persistence via a scheduled task, and C2 over an Azure base domain with a reverse SSH tunnel back to localhost:1081 on the C2 server. That tunnel forwards traffic from the C2 server directly into the compromised network, a pattern Group-IB also pulled from APT hunting as the TWOSTROKE backdoor variant.
Key points
- UNC1549 is a suspected Iran-linked espionage group actively targeting aerospace, defense, and telecom organizations in Europe.
- Initial access is via tailored spear-phishing for credential theft, followed by VDI abuse (Citrix, VMware, Azure) for lateral movement.
- The group has previously leveraged CVE-2021-26855 (CVSS 9.8, EPSS 100%, KEV) and CVE-2020-0688 (CVSS 8.8, EPSS 100%, KEV) for initial access and follow-on exploitation.
- Custom malware family MINIBIKE provides credential theft, keylogging, screenshot capture, and deployment capabilities.
- Campaign active since mid-2024 with supply-chain pivoting into downstream environments.