Threat intelligence / Campaign

C0010

[C0010](https://attack.mitre.org/campaigns/C0010) was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. [C0010](https://attack.mitre.org/campaigns/C0010) began by at least late 2020, and was still ongoing as of mid-2022.(Citation: Mandiant UNC3890 Aug 2022)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[C0010](https://attack.mitre.org/campaigns/C0010) was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. [C0010](https://attack.mitre.org/campaigns/C0010) began by at least late 2020, and was still ongoing as of mid-2022.(Citation: Mandiant UNC3890 Aug 2022)

11 recorded

Relationships

uses

Technique

uses

Technique

uses

to Drive-by Compromise

Technique

uses

to Drive-by Target

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

Malware

uses

Malware

uses

Technique

uses

to Upload Malware

Technique

uses

Technique

2 external

References

mitre-attack

C0010

Mandiant UNC3890 Aug 2022

https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping