UNC2428

An Iran-aligned espionage cluster associated with a 2024 fake-recruitment campaign impersonating the Israeli defense company Rafael. It used tailored social engineering and malware including MURKYTOUR and LONEFLEET to target Israeli and regional interests.