- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored
- Agency named
- IRGC, Ministry of Intelligence, NSA
- Motivation
- Information theft and espionage
- Seen
- 2007
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0309 · magic-kitten
IranWhat it is
Earliest activity back to November 2008. An established group of cyber attackers based in Iran, who carried on several campaigns in 2013, including a series of attacks targeting political dissidents and those supporting Iranian political opposition.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Talos and others
- Group 42, Group42
- Other names
- VOYEUR
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Germany, India, Indonesia, Iraq, Lebanon, Netherlands, Pakistan, Qatar, Sweden, Switzerland, Thailand, United Arab Emirates
- Sectors
- Dissidents, Opposition, Political party
Tools
The tools and malware families the sources tie to it.
- Back Orifice
- Back Orifice 2000
- Cyber Eye RAT
- CyberGate
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de