The Iran-affiliated threat entity identified as UNC2428 has been noted for deploying a backdoor referred to as MURKYTOUR within a job-focused social manipulation initiative targeting Israel in October 2024.
Mandiant, a subsidiary of Google, characterized UNC2428 as a threat entity associated with Iran that participates in cyber surveillance activities. It is reported that this intrusion group has disseminated the malware via a “sophisticated