COBALT GYPSY

Cobalt Gypsy, also known as APT34, Helix Kitten, Hazel Sandstorm, and OilRig, is an Iranian advanced persistent threat operation that has been active since at least 2014. This threat actor has a history of targeting sectors such as telecommunications, government, defense, oil, and financial services primarily in the Middle East. The group's modus operandi typically involves spear-phishing lures leading to the deployment of various backdoors, with its activities bearing similarities to those of other groups like COBALT TRINITY (also known as Elfin and APT33). On October 2, 2023, Cobalt Gypsy's cyberespionage capabilities were significantly bolstered with the introduction of the novel Menorah malware. This new tool was deployed in a spear-phishing campaign, which notably included a Saudi Arabia-based organization among its targets. The Menorah malware represents a significant addition to the group's arsenal, enhancing their ability to conduct sophisticated cyberespionage operations. The cybersecurity industry should remain vigilant in monitoring the activities of Cobalt Gypsy and similar threat actors. The introduction of the Menorah malware demonstrates the group's ongoing commitment to developing new tools and tactics for conducting espionage. It also underscores the need for organizations, particularly those in the targeted sectors and regions, to maintain robust cybersecurity defenses and awareness of potential threats.