Historical intelligence backfill. This assessment covers reporting originally published on 2026-02-10 and was added to the RWP archive on 2026-09-07.
UNC1549 still hires aerospace — fake job portals, resume malware, not a new fighter-jet wiper
GTIG DIB threats 10 February 2026 (and UNC1549 TTP paper) — Iran-nexus UNC1549 and UNC6446. Spoofed job portals, drone-conference domains, resume-builder malware against U.S. and Middle East aerospace/defense. Custom tools in the follow-on paper. Espionage, not confirmed OT.
Bottom line up front
CONFIRMED GTIG’s 10 February 2026 Defense Industrial Base note — Iranian state-sponsored actors UNC1549 and UNC6446 have, since at least 2022, used employment as the exploit. UNC1549: spoofed job portals, fake offers, survey lures, domains mimicking aerospace / thermal-imaging / drone firms and at least one spoofed drone-conference in Asia, aimed at people who want to work at major contractors. UNC6446: resume-builder and personality-test apps that look like HR tools (including UI aimed at a UK multinational) while malware steals recon in the background. Follow-on GTIG “frontline” paper publishes UNC1549 custom tools (DCSYNCER_SLICK, CRASHPAD class utilities in YARA).
This is credential and implant access to people who hold ITAR in their heads. It is not a confirmed process-control incident at a missile plant. Do not merge with AA26-097A internet PLCs.
What happened
The candidate clicks “apply.” The implant does HR’s job plus collection.
Why it matters
DIB hiring is outsourced, rushed, and full of PDFs. That is a better initial-access program than a new CVE.
What is confirmed vs not
CONFIRMED GTIG recruitment TTPs and Iran-nexus clusters.
UNKNOWN named prime-contractor breaches in those posts.
What defenders should do
- Careers sites and recruiter laptops are in the threat model.
- No resume-builder exe from email. Sandbox LNKs.
- Hunt fake contractor/conference domains used in applications.
RWP assessment
Confidence: High on GTIG. Brief HR and the CISO together.
Historical intelligence backfill. This assessment covers reporting originally published on 2026-02-10 and was added to the RWP archive on 2026-09-07.