With its comprehensive passive/listener-based utilities for initial access and lateral movement, UNC1860 may have supported Iranian hacking attacks with the BABYWIPER malware against Israel last October and intrusions with the ROADSWEEP malware against Albania in 2022, an analysis from Google’s Mandiant revealed. “As tensions continue to ebb and flow in the Middle East, we believe this actor’s adeptness in gaining initial access to target environments represents a valuable asset for the Iranian cyber ecosystem that can be exploited to answer evolving objectives as needs shift,”

Source: SC Magazine