Pulse Detail — Threat Intelligence

PULSE NAME

IOC - Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem | Google Cloud Blog

WHITE celestre 2025-11-19 Modified: 2025-12-19

IOCs

MEDIUM VOLUME

↓ CSV ↓ JSON

A new report from security firm Mandiant outlines the tactics and tools used by a group targeting the aerospace, aviation and defense industries in the Middle East in late 2023 to mid-2024.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1003 T1078 T1110 T1113 T1199 T1213 T1574 T1189 T1055 T1218 T1071 T1547 T1036 T1562 T1219 T1049 T1566 T1140 T1106 T1102 T1059 T1021

MALWARE FAMILIES

TWOSTROKE C++ DEEPROOT Linux Azure AD TRUSTTRAP DCSYNCER.SLICK LIGHTRAIL

Indicators of Compromise (2 / 14 total)

All FileHash-MD5 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	10f16991665df69d1ccd5187e027cf3d	—	2025-11-19
FileHash-MD5	b2bd275f97cb95c7399065b57f90bb6c	—	2025-11-19

References (1)

↗ https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense/