Patient Operators

The sector and country distribution describes an operational surface aligned to the institutions most directly implicated in Iranian foreign policy exposure: governments facing strategic friction, defense and aerospace industries linked to regional military balance, and energy infrastructure tied to sanctions leverage. Government leads the corpus — seven of thirteen reports, first documented in December 2017. APT34 source Aerospace and energy follow at three reports each, both dated to September 2017. APT33 source

The country picture reflects the same logic, not just volume. Israel's five reports (first documented August 17, 2022) and Albania's three (all explicit, August 2022 through September 2024) represent two distinct kinds of adversarial exposure — one defined by direct territorial and military friction, the other by political rupture over the presence of Iranian opposition groups. UNC3890 source The United States and United Kingdom appear in three and two reports respectively, with U.S. presence dated to the earliest reporting in the corpus.

Aerospace and energy targeting dates to 2017; Israel-specific targeting, despite its prominence in the country count, does not appear until 2022. Azerbaijan appears in the corpus against a different target profile entirely — NGOs and activists rather than any strategic-sector category — marking a surveillance operation rather than the government, defense, and infrastructure operations that dominate the rest of the record.

The 2017 baseline is established by APT33 and APT34. APT33's documented activity in this corpus connects to U.S. aerospace, Saudi energy, and South Korean energy environments. APT33 source APT34 anchors Middle Eastern government targeting from December 2017. APT34 source Both operations share a common posture: deliberate, sector-specific access rather than broad opportunistic scanning. The techniques in use at this stage - application-layer blending, valid account use - are already present in the 2017 reporting.

By 2022 the picture changes in kind, not just in scale. APT42 reporting shifts attention toward the human layer: social engineering campaigns against government officials, policy researchers, journalists, and NGO workers. APT42 source The February 2022 Telegram malware documentation and the September 2022 APT42 profile together show an operation built for sustained visibility into individuals, not just institutional environments. Telegram case The Albania ROADSWEEP case in August 2022 is the exception in this period - a disruptive action rather than a surveillance or access operation - and its distinctiveness in the corpus reflects something deliberate: it sits at the edge of the ecosystem, not at its center. ROADSWEEP source

The 2024 UNC1860 reporting introduces a qualitatively different layer. Passive backdoors in Middle Eastern telecommunications and government networks, designed to persist without operational noise, represent a shift toward pre-positioning rather than active collection. UNC1860 source The access exists; the question is when and for what it will be used. This is the period in the dataset that most directly frames the current geopolitical context: infrastructure access established years before a potential point of activation.

UNC1549's November 2025 reporting closes the arc. Aerospace and defense targeting under a sustained, technically sophisticated campaign extends the operational surface into the strategic industry layer. UNC1549 source Taken with the telecom footholds of 2024, the endpoint of the dataset suggests an ecosystem that spans infrastructure access, communications penetration, and defense-industrial presence simultaneously.

An employee opens a file. Nothing obvious breaks. The file executes quietly, and the operator has a foothold in an environment with no immediate reason to be suspicious. This entry path — malicious file execution, T1204.002, documented in six of thirteen reports at an average OPTIC confidence of 0.853 — is the most consistent initial access mechanism in the corpus, but the stat matters less than what it enables: a clean handoff to everything that follows. Phishing case

From there, the intrusion proceeds through a sequence that the corpus documents consistently enough to treat as a signature. Command-and-control traffic blends into ordinary web activity - application-layer protocols that look indistinguishable from routine HTTPS traffic. C2 blend Valid accounts, either harvested through prior credential operations or compromised through the initial access, begin accessing systems slightly outside their normal scope. Valid accounts Privilege escalation follows, turning a limited foothold into a durable presence with broader reach. Evidence gets cleaned: indicator removal appears in four reports at an average confidence of 0.725, suggesting operators expect to have time to work and plan accordingly. Communications shift into tunneled protocols - T1572 appears in three reports, at the highest average confidence in the dataset at 0.933, indicating a deliberate effort to shape how traffic flows rather than simply to stay connected. Azure C2 masking

The composite picture across those six techniques is not a sophisticated novel attack. It is a familiar sequence executed with operational discipline. Each individual step - a file opened, a familiar-looking account, a routine web connection - is the kind of thing that defensive tooling is calibrated to ignore in isolation. The power of the playbook is in how each stage hands off to the next without triggering the threshold at which most organizations shift into incident mode.

For a CISO trying to locate this activity in their environment: the diagnostic question is not whether their endpoint protection would catch a known malicious file signature. It is at what point in this sequence their logging and behavioral detection would fire - and whether that point comes before or after the privilege escalation and cleanup phases. In most environments that fit the target profile, the honest answer is: after.

The surveillance lane - anchored by APT42, which appears in three reports across 2022 to 2024 - runs long-horizon visibility operations against individuals: government officials, policy researchers, journalists, and NGO workers. APT42 source The output is sustained intelligence on people and organizations, maintained over months or years. APT39 falls into this lane as well, with a focus on telecommunications and personal data. Facing APT42 surveillance means facing an identity and behavioral monitoring problem: the threat is account-level and human-facing, and the appropriate response centers on phishing-resistant authentication, behavioral monitoring of high-value individual accounts, and awareness training for the specific social engineering patterns documented in the reporting.

The access maintenance lane - APT34, which leads the corpus at four reports from 2017 through 2024, and UNC1860 - keeps quiet footholds alive in regional government, telecommunications, and enterprise environments. These are not operations designed to produce immediate intelligence or disruption. They maintain access that other elements of the ecosystem can use when needed. UNC1860's passive backdoor work in telecommunications environments, documented in 2024, is the clearest expression of this function in the corpus. UNC1860 source

The strategic pressure lane encompasses UNC1549, APT33, and UNC3890, and targets the sectors that carry the most geopolitical weight: aerospace, defense, energy, shipping, and healthcare. UNC1549, with two reports spanning 2024 through 2025, represents the most recent and technically sophisticated development in this lane. UNC1549 2024 UNC3890 source Facing this lane means facing a supply-chain and strategic-industry problem: the threat is infrastructure and production-facing, and the response involves OT security posture, third-party access review across defense supply chains, and threat-informed asset prioritization for the specific sector categories that recur in the corpus.

The disruption lane - UNC788 / HomeLand Justice, documented once in the corpus in connection with the Albania ROADSWEEP attack - sits at the edge of the ecosystem and activates when the political objective requires visible effect. ROADSWEEP source Its single appearance in this dataset is consistent with its function: this is not a persistent presence but a capability that is deployed selectively. The Albania case from 2022 remains the clearest documented example of Iranian cyber operations crossing from quiet access into deliberate disruption.