Actors Insights|Latest update04/07/2026

Cobalt Mirage

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran

Cobalt Mirage is Secureworks' designation for the Iranian IRGC-linked threat cluster known as Nemesis Kitten. Active since at least 2020, Cobalt Mirage exploits public-facing vulnerabilities in enterprise systems for initial access, then pursues a dual mission of ransomware deployment for financial gain and targeted espionage for intelligence collection. Secureworks documented two distinct operational subgroups within Cobalt Mirage — one focused on broad opportunistic ransomware deployment and one on targeted intelligence collection — sharing the same underlying Iranian organizational structure and initial access infrastructure.

First Seen:Jun 2020
Last Seen:Dec 2022
Indexed Reports:3
Public IOCs:73
Cluster: Nemesis KittenMisp: APT35
also known as:
Newscaster Team (Symantec)Magic Hound (Palo Alto)G0059 (Mitre)PHOSPHORUS (Microsoft)Mint Sandstorm (Microsoft)TunnelVision (SentinelOne)COBALT MIRAGE (SecureWorks)Agent SerpensAPT35 (Mandiant)

Targeted Regions

Australia
AU
Australia
Australia
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Europe
EU
Europe
Europe
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Israel
IL
Israel
Israel
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
United States
US
United States
United States
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Jun 2020 ~ May 2022
Feb 2022 ~ Dec 2022
Jun 2020 ~ May 2022
Feb 2022 ~ Dec 2022
Feb 2022 ~ Dec 2022
Feb 2022 ~ Dec 2022
Jan 2020Sep 2026

Targeted Sectors

Human RightsGovernment Agencies and Services

Recent Indexed Reports

  1. Public
    Drokbk Malware: A Tool for COBALT MIRAGE's Cyber Arsenal
  2. Public
    Unveiling the Actors behind COBALT MIRAGE: A Ransomware Incident Analysis

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.