This Alert was updated to reflect newly released information from Microsoft, and to correct the actively exploited Common Vulnerabilities and Exposures (CVEs), which have been confirmed as CVE-2025-49706 and CVE-2025-49704.

The IOCs and TTPs in this advisory were identified in FBI investigations as recently as June 2025 and trusted third-party reporting. Read advisory and implement recommended mitigations to protect your organization. 

In recent years, the cloud landscape has faced increasingly sophisticated threat activity targeting identity and authentication systems. As cloud infrastructure has become more ubiquitous—underpinning key government and critical infrastructure data

CISA, FBI, DC3, and NSA strongly urge organizations to remain vigilant for potential targeted cyber activity against U.S. critical infrastructure and other U.S. entities by Iranian-affiliated cyber actors.

While there are challenges, adopting memory safe languages can increase reliability, reduce attack surface, and decrease long-term costs. 

This advisory encourages executives and network defenders at logistics entities and technology companies to recognize the elevated threat of unit 26165 targeting and implement recommended actions and mitigations.