UNC1549

Mentions · 7d0
Mentions · 30d0
All mentions4
First seenAug 26, 2026
Last mentionedSep 9, 2026

Timeline

4 articles · newest first

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

Cyber Security NewsSep 9, 14:07 UTC · Sep 9, 2026MalwareExploited1

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

GBHackersSep 9, 12:52 UTC · Sep 9, 2026Threat actorExploited3 · 1 read

Iranian cyber spies target aviation, fintech developers with new malware

Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.

The RecordSep 1, 12:38 UTC · Sep 1, 2026Threat actor2 · 1 read

Nimbus Manticore Expands Toolset With TWOSTROKE

Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.

The Hacker NewsAug 26, 15:35 UTC · Aug 26, 2026Threat actorExploited1 · 1 read

Appears with

Nimbus Manticorethreat actor · 3
PollCatmalware · 3
Mirage Kittenthreat actor · 3
Kasperskyvendor · 3
NodeRabbitmalware · 3
Microsoftvendor · 2
NodeRabbitproduct · 2
Visual Studio Codeproduct · 2
Smoke Sandstormthreat actor · 2
PollCatproduct · 2
BridgeHeadproduct · 1
PolySwarmvendor · 1
GitHub Copilotproduct · 1
Tortoiseshellthreat actor · 1
Group-IBvendor · 1
LinkedInorganization · 1

Entities are extracted by the model from each article. First seen Aug 26, 2026, last mentioned Sep 9, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.