MiniBike

This suspected UNC1549 campaign deployed several evasion techniques to mask their activity: Abusing Microsoft Azure infrastructure for C2 and hosting, making it difficult to discern the activity from legitimate network traffic.

Both state-sponsored actors and financially-motivated hackers mostly leveraged compromised identities

The websites would eventually lead to downloading a malicious payload.

Tortoiseshell is described as “targeting supply chains”; Curious Serpens attacked “through phishing and supply chain compromises.”

"Each potential victim receives unique login credentials in advance through spear-phishing communications."

This suspected UNC1549 campaign uses two primary methods to achieve initial access to the targets: spear-phishing and credential harvesting. A typical chain of attack consists of several stages: Spear-phishing emails or social media correspondence, disseminating links to fake websites containing Israel-Hamas related content or fake job offers.

actors linked to Iran and China, who maintained access to the victim environment well over a year and a half

MINIBIKE ... provides a full backdoor functionality, including ... running additional processes. MINIBUS provides a more flexible code-execution and command interface, including the ability to run an executable.

User Execution: The victim runs Setup.exe from the archive.

"...the malicious site deliver weaponized archives containing advanced malware."

A launcher, executed via search-order-hijacking (SoH), deploying MINIBIKE and setting its persistence using registry keys... Once the legitimate executable is run, the MINIBUS installer is installed via search-order-hijacking (SoH).

actors linked to Iran and China, who maintained access to the victim environment well over a year and a half

Both state-sponsored actors and financially-motivated hackers mostly leveraged compromised identities

The loader/installer sets persistence for the MINIBIKE payload by moving it to its staging directory and setting the following Run registry key... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveFileCoAuth.exe ... MINIBUS ... sets persistence for the backdoor using the following registry run key.

actors linked to Iran and China, who maintained access to the victim environment well over a year and a half

Both state-sponsored actors and financially-motivated hackers mostly leveraged compromised identities

The loader/installer sets persistence for the MINIBIKE payload by moving it to its staging directory and setting the following Run registry key... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveFileCoAuth.exe ... MINIBUS ... sets persistence for the backdoor using the following registry run key.

The tools continuously evolve to remain covert, leveraging valid digital signatures, inflate binary sizes, and use multi-stage sideloading and heavy, compiler‑level obfuscation

A benign lure in the form of an application like OneDrive (MINIBIKE) or, in the case of MINIBUS, a custom application presenting content related to Israelis kidnapped by Hamas... Using domain naming schemes that include strings that would likely seem legitimate to network defenders.

Both state-sponsored actors and financially-motivated hackers mostly leveraged compromised identities

A launcher, executed via search-order-hijacking (SoH), deploying MINIBIKE and setting its persistence using registry keys... Once the legitimate executable is run, the MINIBUS installer is installed via search-order-hijacking (SoH).

MINIBIKE ... including directory and file enumeration, collection of system files and information... MINIBUS contains ... more advanced reconnaissance features.

MINIBIKE ... including directory and file enumeration, collection of system files and information, uploading files...

“Lateral movement has typically been achieved through remote services (T1021), such as SMB or RDP …” / “Enter-PSSession … ssh … RDP hijacking …”

Iran-linked threat actor UNC1549 had access to a target environment using stolen VPN credentials and the MiniBike malware.

Payload installation and device compromise, achieved after the MINIBIKE or MINIBUS backdoors establish C2 communication, in most cases via Microsoft Azure cloud infrastructure.

The backdoor uses regular HTTPS requests using the Windows API.

Imperial Kitten is described as “using cloud-based C2 servers”; Tortoiseshell “leveraging cloud infrastructure like Azure for C2.”

MINIBIKE is a custom backdoor written in C++ capable of file exfiltration and upload...

In most of the investigated attacks, the actor's objective was silent exfiltration of high volumes of data without immediate extortion and long-term persistence.