Actors Insights|Latest update28/05/2025

Cobalt Mirage

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran
First Seen:Jun 2020
Last Seen:Dec 2022
Indexed Reports:3
Public IOCs:73
Cluster: Charming KittenMisp: APT35
also known as:
Newscaster Team (Symantec)Magic Hound (Palo Alto)G0059 (Mitre)PHOSPHORUS (Microsoft)Mint Sandstorm (Microsoft)TunnelVision (SentinelOne)COBALT MIRAGE (SecureWorks)APT35 (Mandiant)DEV-0270 (Microsoft)Nemesis Kitten (Crowdstrike)Storm-0270 (Microsoft)

Targeted Regions

Australia
AU
Australia
Australia
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Europe
EU
Europe
Europe
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Israel
IL
Israel
Israel
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
United States
US
United States
United States
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Feb 2022 ~ Dec 2022
Jun 2020 ~ May 2022
Feb 2022 ~ Dec 2022
Feb 2022 ~ Dec 2022
Feb 2022 ~ Dec 2022
Jan 2020Oct 2025

Targeted Sectors

Human RightsGovernment Agencies and Services

Recent Indexed Reports

  1. Public
    Drokbk Malware: A Tool for COBALT MIRAGE's Cyber Arsenal
  2. Public
    Unveiling the Actors behind COBALT MIRAGE: A Ransomware Incident Analysis

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.