COBALT ILLUSION

Cobalt Illusion, also known as Mint Sandstorm, APT42, and TA453 among other names, is a threat actor known for its sophisticated social engineering campaigns. This group is associated with the Islamic Revolutionary Guard Corps and is recognized for conducting surveillance and espionage activities against those seen as threats to the Iranian government. Notably, it has targeted researchers documenting the suppression of women and minority groups. Cobalt Illusion frequently employs legitimate but compromised accounts to send phishing lures as part of its operations. The group's main targets are academics, journalists, human rights defenders, political activists, intergovernmental organizations, and non-governmental organizations focusing on Iran. In recent years, the group has demonstrated an increased capability to exploit n-day vulnerabilities, reducing their response time from weeks to days or even hours, according to Microsoft. This uptick in aggression was reported earlier this year, underscoring the escalating threat posed by this nation-state actor. Phishing and bulk data collection remain core tactics of Cobalt Illusion, which often engages in human-focused intelligence gathering, extracting valuable information such as mailbox contents, contact lists, travel plans, relationships, and physical locations. On February 24th, Secureworks' Counter Threat Unit (CTU) investigated a cluster of activity that bore similarities to past Cobalt Illusion actions. The group's activities bear resemblance to other well-known hacking groups like TA453 and Phosphorus, particularly in its phishing attempts designed to deploy a new version of PowerLess. This software has been previously deployed by Phosphorus in operations throughout the Middle East and Africa. As such, Cobalt Illusion continues to present a significant cybersecurity threat with its advanced tactics and rapid exploitation of vulnerabilities.