Madi
Named by KasperskySuspected state sponsor: Islamic Republic of IranMadi is an Iranian-linked cyber espionage campaign active from approximately July 2011 through mid-2012, first documented by Kaspersky Lab and Seculert. The campaign targeted critical infrastructure operators, engineers, financial firms, and government embassies across Iran, Israel, Afghanistan, and other Middle Eastern countries, infecting over 800 victims. Madi used social engineering via malicious PowerPoint presentations and document files to deliver a custom remote access trojan of the same name that collected screenshots, audio recordings, keystrokes, and files. The campaign is considered an early example of Iranian state-linked cyber espionage infrastructure and is grouped with the Mahdi malware family under the Magic Kitten cluster designation.
Targeted Regions
AfghanistanAfghanistan
Jul 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Jul 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Jul 2011 ~ Jul 2012
AustraliaAustralia
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
EcuadorEcuador
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
GreeceGreece
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
IranIran
Jul 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Jul 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Jul 2011 ~ Jul 2012
IraqIraq
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
IsraelIsrael
Jul 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Jul 2011 ~ Jul 2012 Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Jul 2011 ~ Jul 2012 Dec 2011 ~ Jul 2012
Middle EastMiddle East
Jul 2011 ~ Jul 2012
Jul 2011 ~ Jul 2012
Jul 2011 ~ Jul 2012
MozambiqueMozambique
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
New ZealandNew Zealand
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
Saudi ArabiaSaudi Arabia
Dec 2011 ~ Jul 2012 Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012 Dec 2011 ~ Jul 2012
SwitzerlandSwitzerland
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
United StatesUnited States
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
VietnamVietnam
Dec 2011 ~ Jul 2012
Dec 2011 ~ Jul 2012
Targeted Sectors
Recent Indexed Reports
Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.