UNC1860

Summary

Iranian state-sponsored intrusion group that Mandiant assesses is likely affiliated with the Ministry of Intelligence and Security (MOIS), specialising in passive backdoors on internet-facing Windows servers and in holding long-term access to government and telecommunications networks across the Middle East. CrowdStrike tracks the same adversary as ARCANE KITTEN and lists Scarred Manticore (Check Point), ShroudedSnooper (Cisco Talos), Storm-0861 (Microsoft) and UNC1860 (Mandiant) as its names. Mandiant describes it as a probable initial-access provider: GUI-operated controllers (TEMPLEPLAY, VIROGREEN) let a separate team operate its implants, victims of suspected APT34 were compromised by UNC1860 before or after, and its STAYSHANTE web shell and SASHEYAWAY dropper were indicators in the March 2024 wiper attacks on Israeli organisations. Check Point and MITRE (G1055) report collaboration with VOID MANTICORE, whose Homeland Justice and Karma operations it preceded; Mandiant could not independently corroborate its role in the 2022 Albania and 2023 Israel destructive attacks. Signature tradecraft is abuse of the Windows HTTP.sys driver to receive commands in ordinary web traffic (Check Point's LIONTAIL, Talos's HTTPSnoop), masquerading as Exchange Web Services or security-product components, and a kernel-mode driver repurposed from an Iranian anti-virus product.

Attribution

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Mandiant (Research, 2024-09-19)
  Likely affiliated with the Ministry of Intelligence and Security
• Check Point Research (Research, 2023-10-31)
  Tracks it as Scarred Manticore, MOIS-affiliated
• CrowdStrike (Research, 2026-10-15)
  Iranian state-nexus adversary

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Infrastructure patterns

• Passive implants (TEMPLEDOOR) on compromised servers, built for hand-off to other actors (Mandiant, 2024)

Reporting and advisories 3

• Mandiant
  UNC1860 and the Temple of Oats
• Check Point Research
  The Scarred Manticore is Listening (LIONTAIL)
• Cisco Talos
  ShroudedSnooper (HTTPSnoop / PipeSnoop)