ctrlINT What the industry said about every indicator, with the quote

CHRYSENEThreat actor

  • apt 34
  • APT34
  • atk40
  • crambus
  • earth simnavaz
  • europium
  • evasive serpens
  • g0049
  • greenbug
  • hazel sandstorm
  • helix kitten
  • irn2
  • itg13
  • solar ion
  • ta452
  • twisted kitten

Adversaries abusing ICS (based on Dragos Inc adversary list). This threat actor targets organizations involved in oil, gas, and electricity production, primarily in the Gulf region, for espionage purposes. According to one cybersecurity company, the threat actor “compromises a target machine and passes it off to another threat actor for further exploitation.”From MISP Galaxy

Last reported 3 months ago, by SentinelLabs4 reports

Suspected originIranMISP Galaxy
Targets sectorsGovernment, NGOs, manufacturing, energy, finance, telecomMISP Galaxy
Targets countriesIraq, United Kingdom, Pakistan, IsraelMISP Galaxy

ATT&CK techniques

6 of 18 · each with the sentence it comes from
  1. T1036Masquerading

    “This variant utilizes a .vbs dropper by masquerading as a .doc file, as Windows still hides the original filename extension by default.”

    Elastic Security LabsVendor
  2. T1053.005Scheduled Task

    “In this post, we’ll explore two additional persistence techniques that are being used by attackers in the wild: Scheduled Tasks (T1053) and BITS Jobs (T1197).”

    Elastic Security LabsVendor
  3. T1684Social Engineering

    “Espionage via recruitment-themed social engineering, aligned with IRGC strategic priorities”

    SentinelLabsVendor
  4. T1001.003Protocol or Service Impersonation

    “T1001.003”

    Zscaler ThreatLabzVendor
  5. T1047Windows Management Instrumentation

    “Finally, it examined a popular technique used by adversaries to maintain persistence, Windows Management Instrumentation (WMI) Event Subscription (T1084).”

    Elastic Security LabsVendor
  6. T1053Scheduled Task/Job

    “In this post, we’ll explore two additional persistence techniques that are being used by attackers in the wild: Scheduled Tasks (T1053) and BITS Jobs (T1197).”

    Elastic Security LabsVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

4 reports, newest first · the exact sentence from each

  1. “Previously documented APT34 activity against Iraqi government infrastructure shows a durable mission of collecting political, diplomatic, and telecommunications intelligence from neighboring states.”

    SentinelLabsVendor
    Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

  2. “…raq’s government sector, particularly the Ministry of Foreign Affairs, has been targeted in the past by Iran-nexus threat actors such as APT34.”

    Zscaler ThreatLabzVendor
    Dust Specter APT Targets Government Officials in Iraq

  3. “Threat actors like APT34, APT29, and FIN6 have been known to use scheduled tasks as a means to persist.”

    Elastic Security LabsVendor
    Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2)

  4. “…e” of Iranian APT groups began with someone by the username Lab Dookhtegan releasing the source code of six tools belonging to the group APT34 (aka OilRig and HelixKitten).”

    Group-IBVendor
    Catching fish in muddy waters

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with CHRYSENE here?
No account needed. We do not store your IP address.