Loading malware…
OATBOAT is a Windows malware loader associated with the Iranian state-sponsored threat cluster UNC1860, which is assessed to be affiliated with the Ministry of Intelligence and Security. It is used in stealth-focused intrusion chains targeting high-priority networks in the Middle East, particularly government and telecommunications organizations. OATBOAT loads and executes shellcode payloads and has been observed carrying passive implants such as TOFULOAD and TOFUPIPE. In broader UNC1860 operations, these payloads support long-term covert access by relying on passive listener-style communications rather than conventional outbound command-and-control traffic, complicating network detection and enabling durable post-compromise access. OATBOAT appears in the actor’s later-stage tooling set and is part of a wider ecosystem that includes web shells, droppers, passive backdoors, and operator controllers used to establish footholds, maintain persistence, and facilitate follow-on access for other Iranian operators. Its role is best characterized as a shellcode-loading component within UNC1860’s espionage-oriented tradecraft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OATBOAT ... CyveraConsole.exe_OATBOAT that contains encrypted shellcode of TOFULOAD ... OATBOAT with TOFULOAD shellcode
3 distinct techniques documented for this family, organized by ATT&CK tactic.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A main-stage backdoor/loader that loads and executes additional payloads (including passive TCP listeners) and leverages stealthy techniques (e.g., undocumented HTTP.sys functionality) to evade detection.
Loader used to load and execute shellcode payloads.
A loader/staging component used to carry or load encrypted TOFULOAD or TOFUPIPE shellcode.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.