UNC1549 is a suspected Iranian threat actor that targets aerospace and defense organizations in the Middle East. It delivers a backdoor called MINIBUS through spear-phishing emails. It is believed to overlap with the Tortoiseshell activity cluster, which CERT-EU links to Iran’s Islamic Revolutionary Guard Corps. This post analyses how the MINIBUS backdoor works.
This blog post comes from the UNC1549 MINIBUS Backdoor Technical Analysis report. If you want to download it as a PDFclick here
Who is UNC1549 and what is the MINIBUS backdoor?
In the evolving cyber espionage landscape, state-sponsored threat actors’ activities targeting critical sectors have become increasingly sophisticated and widespread. A notable example of such activities is the campaign orchestrated by the Iranian threat actor known as UNC1549. This group has been implicated in espionage efforts targeting the aerospace and defense sectors in the Middle East, including Israel and the United Arab Emirates (UAE).
CERT-EU links the activity to the Tortoiseshell activity cluster and describes a potential link to Iran’s Islamic Revolutionary Guard Corps (IRGC) [1]. The current situation seems consistent, given the strategic importance of the targeted sectors and the background of regional tensions such as the Israel-Hamas conflict. A sample analyzed in this report is named bringthemhomenow.zip, which points to a lure built around the Israel-Hamas war.
- Type
- Suspected Iranian threat actor
- Targets
- Aerospace and defense in the Middle East
- Overlap
- Tortoiseshell activity cluster
- Lure used
- Israel-Hamas war theme
- Backdoor
- MINIBUS
This detailed technical analysis report aims to dissect the architecture, functionalities, and implications of the MINIBUS Backdoor, shedding light on its role within the broader context of regional cyber espionage activities. The deployment of MINIBUS through deceptive means, such as a spear-phishing attachment, underscores the threat actor’s emphasis on stealth and evasion. By masquerading as legitimate entities and exploiting trusted cloud infrastructure for command and control (C2) communications, UNC1549 has demonstrated high sophistication and an ability to circumvent traditional security measures. This report will delve into the technical specifics of the MINIBUS malware, including its payload delivery mechanisms, C2 infrastructure, and the unique features that distinguish it from previous tools used by the group.
- Phishing attachmentA ZIP archive reaches the victimTechnique T1566.001 (MITRE ATT&CK, opens in a new tab)
- Fake extraction dialogThe victim sees a fake extracting message
- Installer DLLsecur32.dll starts the infection
- Backdoor DLLCoreUIComponent.dll is the MINIBUS backdoor
- PersistenceRegistry Run Keys keep the malware runningTechnique T1547.001 (MITRE ATT&CK, opens in a new tab)
- Cloud command and controlTrusted cloud services carry the traffic
Scope
| Filename | bringthemhomenow.zip |
| Filetype | ZIP |
| Written Language | N/A |
| MD5 | ef262f571cd429d88f629789616365e4 |
| SHA1 | ff1c547f22708d27688d412006c9c0b357d2eac5 |
| SHA256 | fc95b67fa0664bf2d542f07120a3b51d47ff8eb55a94d00e16827eea26483206 |
| First Seen / Detection Date | 2024-01-03 |
| Initial Infection Vector | Phishing Attachment |
| Filename | secur32.dll |
| Filetype | Win32 DLL |
| Written Language | C/C++ |
| MD5 | c5dc2c75459dc99a42400f6d8b455250 |
| SHA1 | 0ead4133b81cb9f68077df1f3cb9c3ca26a04cc4 |
| SHA256 | 26ca51cb067e1fdf1b8ad54ba49883bc5d1945952239aec0c4840754bff76621 |
| First Seen / Detection Date | 2024-01-04 |
| Initial Infection Vector | ZIP Archive |
| Filename | CoreUIComponent.dll |
| Filetype | Win32 DLL |
| Written Language | C/C++ |
| MD5 | 816af741c3d6be1397d306841d12e206 |
| SHA1 | 4df79bb9c601ef53255ac19be5ca807dc0c5c835 |
| SHA256 | 10e9d1eaf24ad3c63578d89f8b887adb47700aae02da1532c4842428725e77d6 |
| First Seen / Detection Date | 2024-01-04 |
| Initial Infection Vector | ZIP Archive |
How can organizations defend against UNC1549?
- Implement strict access control policies. Ensure that users have only the access they need to perform their jobs.
- Use email scanning solutions to detect malicious attachments and links within emails.
- Conduct regular training to educate users about the latest phishing tactics and how to recognize suspicious emails and links.
- You can search the FileCoAuth.exe data for the malware we found to use Registry Run Keys to ensure persistence.
- Detecting suspicious traffic can be challenging because UNC1549 often uses legitimate services to hide network traffic and avoid detection in its campaigns. However, you can catch suspicious traffic by monitoring the HTTP header information that we found to be generated in web requests.
- You can check the existence of the %LOCALAPPDATA%\Microsoft\OneDrive\cache\logger directory and the files copied to the directory, if any.
Conclusion
The malware’s ability to masquerade as legitimate applications and utilize cloud infrastructure for command and control (C2) communications complicates detection efforts and necessitates a multi-layered approach to security. The operational context in which MINIBUS has been deployed—targeting critical sectors with significant geopolitical implications—emphasizes the importance of sector-specific threat intelligence and collaboration. Sharing insights and indicators of compromise (IoCs) across organizations and industries can enhance collective defense mechanisms and prevent the successful execution of espionage campaigns. It is also a stark reminder of organizations’ need to foster a culture of security awareness, training employees to recognize and respond to social engineering tactics that are often the first step in such sophisticated attacks.
This blog post comes from the UNC1549 MINIBUS Backdoor Technical Analysis report. If you want to download it as a PDFclick here
References:
[1] CERT-EU. Cyber Security Brief 24-03, February 2024.
url: https://cert.europa.eu/publications/threat-intelligence/cb24-03/ (Accessed: 08.10.2026).