An ongoing cyber-espionage campaign has been attributed with medium confidence to the Iranian-linked threat actor known as UNC1549, using a new set of attacks and unique malware strains against aerospace, aviation, and defense industries in the Middle East, including Israel and the United Arab Emirates (UAE). UNC1549 also overlaps with another threat actor known as Tortoiseshell, Imperial Kitten, or Crimson Sandstorm, which has purported affiliations to Iran’s Islamic Revolutionary Guard Corp (IRGC), being important given the group’s focus on defense-related entities in light of rising tensions in Iran and their support of Hamas militants in Gaza. This campaign, however, started as early as June 2022 and is still ongoing. Researchers have noted the use of spear-phishing emails with phony job offers or links to fake websites bolstering Israel-Hamas related content to deliver malicious payloads, as well as using typosquatted login pages of major companies to harvest credentials. Attacks have often used Microsoft Azure cloud infrastructure for commands-and-control (C2), and the payloads discussed earlier deliver two (2) backdoors dubbed MINIBIKE and MINIBUS. MINIBIKE has been observed between June 2020 through October 2023 and uses Azure cloud infrastructure with capabilities of file exfiltration and uploads, along with command execution. MINIBUS, on the other hand, has greater reconnaissance features with a “more flexible code execution interface,” observed first in August 2023 and was last seen as recently as January 2024. In tangent, they create the perfect cyber-espionage weapon, being enabled only further by a custom “tunneler” called LIGHTRAIL that helps wrap internet traffic and hide malicious activity. All in all, this campaign uses tactics, techniques, and procedures (TTPs) that make activity difficult to prevent, detect and mitigate.