Iran1 malware family

Cuboid Sandstorm

Tortoise Shell is referenced as an Iran-linked threat actor that overlaps with UNC1549 and is also associated in reporting with CURIUM and Crimson Sandstorm. In the cited material, UNC1549 (aka GalaxyGato, Nimbus Manticore, or Subtle Snail) is described as an Iranian state-sponsored group and is reported to have focused attacks on defense, aerospace, telecommunications, and regional government entities, with Nozomi Networks telemetry ranking UNC1549 as the fourth most active actor in 2H 2025. No additional Tortoise Shell-specific TTPs, tooling, victimology, or sub-group structure are directly provided beyond this stated overlap/association.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

8 of 15 tactics11 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

T1566.001

Spearphishing Attachment

TA0002

Execution

1 technique

T1059

Command and Scripting Interpreter

T1059.001

PowerShell

TA0003

Persistence

1 technique

T1547

Boot or Logon Autostart Execution

TA0004

Privilege Escalation

1 technique

T1547

Boot or Logon Autostart Execution

TA0005

Stealth

1 technique

T1027

Obfuscated Files or Information

TA0006

Credential Access

1 technique

T1555

Credentials from Password Stores

TA0011

Command and Control

1 technique

T1071

Application Layer Protocol

T1071.001

Web Protocols

TA0040

Impact

1 technique

T1498

Network Denial of Service

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

TAMECATAnalysis of recent campaigns introduces TameCat, a modular, PowerShell-based backdoor used to target senior defense and government officials.2Mar 4, 2026

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

socradar blogNews

Mar 5, 2026

Tracking the U.S.-Israel-Iran War with OSINT Tools: A Practical Guide

Referenced as an APT group tracked as part of the cyber dimension of the conflict; no specific TTPs or tooling are described in the content.

huntio blogNews

Mar 4, 2026

Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation

Iran-linked espionage-focused operations targeting senior defense and government officials using a modular PowerShell backdoor (TameCat).

nozomi networks blogNews

Mar 2, 2026

Iranian APT Activity During Geopolitical Escalation: Recommendations for Nozomi Customers and Critical Infrastructure Owners

Iran-aligned activity cluster focused on defense, aerospace, telecommunications, and regional government entities, with operations aligned to Iran’s geopolitical priorities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping8

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.