ShroudedSnooper

ShroudedSnooper is a suspected Iranian state-sponsored threat actor active since at least 2019, first documented by Cisco Talos in 2023. The group targets telecommunications providers in the Middle East, with documented victims in Iraq. ShroudedSnooper is known for deploying custom implants — including HTTPSnoop and PipeSnoop — that abuse legitimate Windows components for covert access. HTTPSnoop hooks into the Windows HTTP kernel driver to listen for attacker-crafted HTTP requests, allowing the implant to blend into normal server traffic. The group gains initial access through internet-facing servers and focuses on persistent intelligence collection from communications infrastructure of strategic interest to Iranian state actors.