Follow us on Google News
An Iran-affiliated cyber espionage group known as UNC1549, tracked by Swiss cybersecurity firm PRODAFT under the codename Subtle Snail, has launched a campaign targeting European telecommunications companies. The operation successfully compromised 34 devices across 11 organizations in Canada, France, UAE, the UK, and the US. The group poses as HR representatives on LinkedIn to engage employees and deploy malware, a tactic first observed targeting aerospace organizations in 2023.
https://the420.in/futurecrime-future-crime-summit-2026-new-delhi-fcrf-tech-crime-law-enforcement-cybersecurity-dfir-conference/
MINIBIKE Backdoor and Infection Chain
After identifying key personnel such as researchers and IT administrators, Subtle Snail sends spear-phishing emails and sets up fake recruitment profiles. Victims who click on fraudulent domains mimicking companies like Telespazio or Safran Group download ZIP archives containing executables. These executables use DLL side-loading to deploy MINIBIKE, a modular backdoor capable of logging keystrokes, stealing Outlook credentials, collecting browser data, taking screenshots, and performing reconnaissance across the system.
Advanced Evasion and Persistence Techniques
MINIBIKE blends command-and-control traffic with legitimate Azure cloud communications and modifies the Windows Registry for startup persistence. It incorporates anti-debugging, sandbox evasion, control flow flattening, and custom hashing algorithms to resist analysis and reverse engineering. Each DLL deployed is unique per victim, further complicating detection. Subtle Snail actively hunts for sensitive data, including emails, VPN configurations, and confidential shared files, to maintain long-term access to target networks.
Strategic Cyber Espionage Objectives
PRODAFT reports that the group’s overarching aim is long-term infiltration of telecommunications while maintaining interests in aerospace and defense. UNC1549 shares overlaps with other Iranian threat actors such as Smoke Sandstorm and Crimson Sandstorm, reflecting coordinated efforts to support Iran’s strategic intelligence objectives. The operation highlights the increasing sophistication of Iranian cyber campaigns and the need for organizations to implement robust employee awareness, network monitoring, and threat detection protocols.
