COBALT GYPSY

Threat Actor Profile Updated 13 days ago
Download STIX
Preview STIX
Cobalt Gypsy, also known as APT34, Helix Kitten, Hazel Sandstorm, and OilRig, is an Iranian advanced persistent threat operation that has been active since at least 2014. This threat actor has a history of targeting sectors such as telecommunications, government, defense, oil, and financial services primarily in the Middle East. The group's modus operandi typically involves spear-phishing lures leading to the deployment of various backdoors, with its activities bearing similarities to those of other groups like COBALT TRINITY (also known as Elfin and APT33). On October 2, 2023, Cobalt Gypsy's cyberespionage capabilities were significantly bolstered with the introduction of the novel Menorah malware. This new tool was deployed in a spear-phishing campaign, which notably included a Saudi Arabia-based organization among its targets. The Menorah malware represents a significant addition to the group's arsenal, enhancing their ability to conduct sophisticated cyberespionage operations. The cybersecurity industry should remain vigilant in monitoring the activities of Cobalt Gypsy and similar threat actors. The introduction of the Menorah malware demonstrates the group's ongoing commitment to developing new tools and tactics for conducting espionage. It also underscores the need for organizations, particularly those in the targeted sectors and regions, to maintain robust cybersecurity defenses and awareness of potential threats.
What's your take? (Question 1 of 1)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
OilRig
2
OilRig is a well-known threat actor in the cybersecurity landscape, notorious for its sophisticated attacks on various targets, including Middle Eastern telecommunications organizations and Israel's critical infrastructure sector. This entity has been linked to several high-profile campaigns such as
APT34
2
APT34, also known as OilRig, EUROPIUM, Hazel Sandstorm, and Crambus among other names, is a threat actor believed to be operating on behalf of the Iranian government. Operational since at least 2014, APT34 has been involved in long-term cyber espionage operations primarily focused on reconnaissance
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the COBALT GYPSY Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
7 months ago
New Menorah malware bolsters OilRig APT's cyberespionage efforts
CERT-EU
7 months ago
Progress Software ‘disappointed’ researchers published PoC of newly-patched bug
CERT-EU
7 months ago
AI security center mulled by NSA
CERT-EU
7 months ago
ALPHV/BlackCat ransomware attack hits major Michigan health system
MITRE
a year ago
Cyber Threat Group LYCEUM Takes Center Stage in Middle East Campaign
CERT-EU
7 months ago
APTs, botnets combated by new AWS system
CERT-EU
7 months ago
Novel LostTrust ransomware operation emerges
CERT-EU
7 months ago
Novel BunnyLoader MaaS threat examined
CERT-EU
8 months ago
Alert: Phishing Campaigns Deliver New SideTwist Backdoor and Agent Tesla Variant
CERT-EU
7 months ago
New ASMCrypt malware loader detailed