IRIDIUM
IRIDIUM is classified as state-sponsored.
- Malware families
- 15
- Origin
- Iran
Resecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a nation-state actor whom we are calling IRIDIUM. This actor targets sensitive government, diplomatic, and military resources in the countries comprising the Five Eyes intelligence alliance (which includes Australia, Canada, New Zealand, the United Kingdom and the United States)
The group's reported origin is Iran.
The group is associated with 15 malware families.
The group is associated with 15 malware families.
Malware families
- ArguePatch
- BACKORDER
- BlackEnergy
- CaddyWiper
- EternalPetya
- INDUSTROYER2
- Kalambur
- Kapeka
- KillDisk
- LocalOlive
- Rhadamanthys
- RoarBAT
- SwiftSlicer
- TeleBot
- TeleDoor
Published reports on this actor:
- https://www.nbcnews.com/politics/national-security/iranian-backed-hackers-stole-data-major-u-s-government-contractor-n980986
- https://threatpost.com/ranian-apt-6tb-data-citrix/142688/
- https://hub.packtpub.com/resecurity-reports-iriduim-behind-citrix-data-breach-200-government-agencies-oil-and-gas-companies-and-technology-companies-also-targeted/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.