Actors Insights|Latest update24/07/2026

Greenbug

Named by SymantecSuspected state sponsor: Islamic Republic of Iran

Greenbug is an Iranian state-linked cyber espionage cluster active since at least 2016, first documented by Symantec. The group specializes in targeting telecommunications, internet service providers, aviation, and energy companies across Saudi Arabia, Iraq, Bahrain, Qatar, Kuwait, and Turkey using spear phishing with fake business proposals to deliver its custom Ismdoor remote access trojan. Ismdoor uses DNS tunneling — and later DNS TXT record-based command and control — enabling covert credential theft and keylogging while blending into normal DNS traffic. Symantec assessed that Greenbug likely provided the credentials used by the Shamoon operators in the November 2016 Disttrack attacks, after detecting an Ismdoor infection on an administrator machine at a Shamoon-targeted organization days before the wiper deployment. Unit 42 identified a modified ISMDoor variant called ISMAgent deployed by OilRig operators in 2017, establishing shared tooling between Greenbug and OilRig and suggesting the groups are closely linked or overlapping within the same Iranian state espionage infrastructure.

First Seen:Jun 2016
Last Seen:Sep 2024
Indexed Reports:9
Public IOCs:158
Cluster: UnclassifiedMisp: CHRYSENE
also known as:
OilRig (Palo Alto)Greenbug (Symantec)Chrysene (Dragos)

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Australia
AU
Australia
Australia
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Bahrain
BH
Bahrain
Bahrain
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
France
FR
France
France
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Germany
DE
Germany
Germany
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Iran
IR
Iran
Iran
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Iraq
IQ
Iraq
Iraq
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Israel
IL
Israel
Israel
Oct 2017 ~ Oct 2017
Kuwait
KW
Kuwait
Kuwait
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Middle East
ME
Middle East
Middle East
Jan 2017 ~ Jan 2017
Aug 2017 ~ Aug 2017
Pakistan
PK
Pakistan
Pakistan
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Qatar
QA
Qatar
Qatar
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Russia
RU
Russia
Russia
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jun 2016 ~ May 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ May 2017
Jun 2016 ~ Jan 2017
Jan 2017 ~ Jan 2017
Jun 2016 ~ May 2017
Jun 2016 ~ Jan 2017
Oct 2017 ~ Oct 2017
Turkey
TR
Turkey
Turkey
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
Jun 2016 ~ Jan 2017
United States
US
United States
United States
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Nov 2017 ~ Sep 2019
Jan 2016Jul 2026

Targeted Sectors

Government Agencies and ServicesAerospaceInformation TechnologyBankingTelecommunicationFinancialEnergyUniversityHigh-Tech

Recent Indexed Reports

  1. Public
    Greenbug's Cyber Espionage Campaign Against South Asian Telecoms
  2. Public
    Decoding Greenbug Group's Command and Control Communications via DNS Tunneling
  3. Public
    How the GreenBug Group Exploits DNS Tunneling with Ismdoor Malware
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.