RaqibCTI APT / State-sponsored
TA455Smoke SandstormYellow Dev 13BOHRIUM
Attribution
Iran — suspected IRGC-nexus (moderate confidence per Mandiant)
Attribution confidence
medium
MENA targeting
Israel, UAE (primary); Turkey (secondary)
Sectors
Aerospace, aviation, defense, thermal-imaging manufacturing, telecom
Corpus activity · 6mo2 mentions
AMJJAS
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel, UAE (primary); Turkey (secondary) (Aerospace, aviation, defense sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Reporting history
8 reports · 0 publishersThird-party sources archived via ORKL — not RaqibCTI assessments. Reported since 2024-02-08.
B2026-03-25
2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en
B2025-10-30
eset-apt-activity-report-q2-2025-q3-2025.pdf
actor
Technique overlap
←UNC1549 / TA455 · NightLedgercampaignCorrelated cluster2026-08-12←2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=enreportORKL2026-03-25←eset-apt-activity-report-q2-2025-q3-2025.pdfreportORKL2025-10-30←Mandiant M-Trends 2025 ReportreportORKL2025-04-24←Investigating Iranian Intrusion into Strategic Middle East Critical InfrastructurereportORKL2025-03-07←Iranian "Dream Job" campaignreportORKL2024-11-12←When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense SectorsreportORKL2024-03-13←Staying ahead of threat actors in the age of AIreportORKL2024-02-20←Israel-Hamas War in Cyber February 2024 Tool of First ResortreportORKL2024-02-08Uses
- →Exfiltration Over C2 ChanneltechniqueATT&CK mapping
- →Web ServicetechniqueATT&CK mapping
- →Acquire Infrastructure: DomainstechniqueATT&CK mapping
- →User Execution: Malicious FiletechniqueATT&CK mapping
- →Protocol TunnelingtechniqueATT&CK mapping
- →Phishing: Spearphishing via ServicetechniqueATT&CK mapping
- →Establish Accounts: Social Media AccountstechniqueATT&CK mapping
C2025-04-24
Mandiant M-Trends 2025 Report
C2025-03-07
Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure
B2024-11-12
Iranian "Dream Job" campaign
C2024-03-13
When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors
C2024-02-20
Staying ahead of threat actors in the age of AI
C2024-02-08
Israel-Hamas War in Cyber February 2024 Tool of First Resort
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
- MalwareNightLedgerco-mentioned in 2 items
- MalwareArcBridgeco-mentioned in 2 items
- MalwareBridgeHeadco-mentioned in 2 items
- SectorAerospace/Telecom (implied by Mirage Kitten targeting)co-mentioned in 1 item
- TechniqueT1195co-mentioned in 1 item
- CountryRussiaco-mentioned in 1 item
- MalwareCreduzco-mentioned in 1 item
- TechniqueT1476co-mentioned in 1 item
- SectorDiplomatic organizationsco-mentioned in 1 item
- MalwareMobiDashco-mentioned in 1 item
- SectorPublic sectorco-mentioned in 1 item
- MalwareAnatsaco-mentioned in 1 item