- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- Iran (Islamic Republic of)
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2011–2012
- Status
- Dormant
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0134 · madi
IranWhat it is
Kaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign. Kaspersky Lab and Seculert identified more than 800 victims located in Iran, Israel and select countries across the globe connecting to the C&Cs over the past eight months. Statistics from the sinkhole revealed that the victims were primarily business people working on Iranian and Israeli critical infrastructure projects, Israeli financial institutions, Middle Eastern engineering students, and various government agencies communicating in the Middle East. Common applications and websites that were spied on include accounts on Gmail, Hotmail, Yahoo! Mail, ICQ, Skype, Google+, and Facebook. Surveillance is also performed over integrated ERP/CRM systems, business contracts, and financial management systems.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Mahdi
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, Ecuador, Greece, Iran, Iraq, Israel, Mozambique, New Zealand, Pakistan, Saudi Arabia, Switzerland, United States, Vietnam
- Sectors
- Education, Engineering, Finance, Financial, Government, Government, Administration, Infrastructure, Oil and gas, Private sector, Think Tanks
Tools
The tools and malware families the sources tie to it.
- CrossRat
- Madi
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de