Actors Insights|Latest update29/07/2026

IRN2

Named by Area 1Suspected state sponsor: Islamic Republic of Iran

IRN2 is ClearSky Cyber Security's designation for recent activity attributed to the OilRig/APT34 cluster. ClearSky has documented IRN2 conducting espionage operations against Israeli and Middle Eastern targets using updated tooling including VEATY and SPEARAL backdoors that abuse legitimate online services for covert command and control. The IRN2 designation reflects ClearSky's independent tracking of OilRig activity in the Israel-focused threat intelligence space, covering the cluster's continued operations through 2025.

First Seen:Aug 2022

Last Seen:Mar 2025

Indexed Reports:0

Public IOCs:0

Cluster: OilRigMitre: OilRigMisp: OilRig

also known as:

Twisted Kitten (CrowdStrike)COBALT GYPSY (SecureWorks)Crambus (Symantec)Helix Kitten (CrowdStrike)APT 34IRN2 (Area 1)ATK40 (Thales)G0049 (Mitre)Evasive SerpensHazel Sandstorm (Microsoft)EUROPIUM (Microsoft)TA452 (Proofpoint)Earth Simnavaz (Trend Micro)OilRig (Palo Alto)ITG13 (IBM)

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.