Iran-Nexus Threat Actor
An Iran-linked threat actor group associated with the BLUERABBIT backdoor, targeting Israeli organizations. Attribution is based on intelligence from Google's Threat Intelligence…
Tag: Iran
Binary Defense: Cybersecurity Firm
Binary Defense identified the same malware as BLUERABBIT and tied it to an Iran-nexus group targeting Israeli organizations, citing Google's Threat Intelligence…
GigaWiper: New Windows Backdoor Combines Disk Wiping, Fake Ransomware, and Spyware
Microsoft has dismantled a destructive Windows backdoor named GigaWiper, which combines three older malicious tools into a single platform. The malware, written…
GigaWiper: Destructive Backdoor with Disk-Wiping Capabilities
GigaWiper is a post-compromise backdoor detailed by Microsoft that can wipe disks, overwrite Windows drives, or run fake ransomware. It also includes…
Iran-Linked Hackers Deploy New Cavern C2 Framework in Targeted Attacks on Israeli Organizations
Iranian state-sponsored hackers affiliated with the Ministry of Intelligence and Security (MOIS) have been using a previously undocumented modular command-and-control (C2) framework…
Cavern Manticore: Iran-Linked Hacking Group
Cavern Manticore is a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS), known for using the Cavern C2 framework.…
Lyceum: OilRig Sub-Group
Lyceum is a sub-group of OilRig, sharing overlaps with Cavern Manticore. It is involved in cyber espionage activities, often using custom malware.
OilRig (APT34): Iranian Threat Actor
OilRig, also known as APT34, is an Iranian threat actor linked to Cavern with low confidence. It has used Microsoft-hosted services for…
Cavern C2 Framework: Evolution and Capabilities
Cavern (aka Cav3rn) is a modular command-and-control framework used by Iranian nation-state hackers, linked to Cavern Manticore. It supports various post-exploitation modules…
SentinelOne: Analyzes Multi-Pronged Iran-Linked Cyber Threat Landscape
SentinelOne is a cybersecurity company that characterized Iran-linked cyber activity as a multi-pronged threat comprising various clusters with distinct missions, targeting, and…