Helix Kitten

Helix Kitten, also known as APT34, OilRig, Cobalt Gypsy, Hazel Sandstorm, and Crambus, is a threat actor believed to originate from Iran. The group has been tracked by various cybersecurity firms including FireEye, Symantec, and CrowdStrike, each using different names to identify the same entity. The group is associated with Iran's Ministry of Intelligence and Security (MOIS) and has been active since at least 2014, targeting sectors such as telecommunications, government, defense, oil, and financial services primarily in the Middle East. The group's operations have involved sophisticated techniques including spear-phishing lures that lead to the deployment of various backdoors. In one notable incident, Helix Kitten assumed the identity of Ganjavi Global Marketing Services (GGMS), a marketing services company, to conduct a phishing attack. This operation was detected by NSFOCUS Security Labs, highlighting the group's ability to adapt and evolve its tactics to achieve its objectives. Moreover, the group has demonstrated its capabilities by exploiting publicly available tools and previously undiscovered pieces of malware to access systems, maintain persistence, and steal data. One of its more innovative efforts involved hijacking attack tools and command-and-control servers used by another Iranian nation-state group, Turla. As such, Helix Kitten represents a significant threat due to its advanced capabilities, persistent activities, and links to state-sponsored cyber espionage.