A sophisticated cyber operation within Iran’s Ministry of Intelligence and Security (MOIS) has been identified as a significant initial access broker for other Iranian hackers, providing persistent entry into telecommunications and government organizations across the Middle East. This Iranian APT, UNC1860, has been active since at least 2020 and has developed a collection of specialized tools and passive backdoors that support other Iranian hacking activities, including espionage and network attack operations. The FBI just recently reported that the group of Iranian hackers who attempted to steal and disseminate documents from former President Donald Trump’s campaign are likely associated with UNC1860. UNC1860’s tools are designed to evade antivirus software, maintaining long-term, stealthy access to compromised systems. These tools have been utilized by other MOIS-affiliated groups, such as APT34, and have been linked to destructive cyber operations, including attacks on Israel in 2023 and Albania in 2022. The group’s arsenal includes various malware controllers like TEMPLEPLAY and VIROGREEN, which provide remote access and facilitate post-exploitation activities within target networks. The tools and techniques employed by UNC1860 include a range of backdoors and loaders, such as OATBOAT, TOFUDRV, TOFULOAD, and TEMPLELOCK, which facilitate initial access, lateral movement, and information gathering within victim networks. These tools highlight the group’s capability to maintain persistent access and conduct extensive reconnaissance without detection. The increasing sophistication and boldness of Iranian cyber operations have drawn significant attention from security researchers and government agencies. As tensions continue rising in the Middle East, UNC1860’s ability to gain and maintain access to high-priority networks is considered a valuable asset for Iran’s cyber ecosystem, capable of adapting to evolving objectives.