Actors Insights|Latest update05/06/2025

Cobalt Gypsy

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran
First Seen:Apr 2016
Last Seen:Feb 2023
Indexed Reports:3
Public IOCs:54
Cluster: OilRigMitre: OilRigMisp: Cleaver
also known as:
Operation CleaverOp CleaverTarh Andishan (Cylance)AlibabaTG-2889 (SecureWorks)COBALT GYPSY (SecureWorks)G0003 (Mitre)OilRig (Palo Alto)IRN2 (Area 1)APT34 (Mandiant)Helix Kitten (CrowdStrike)Evasive SerpensHazel Sandstorm (Microsoft)EUROPIUM (Microsoft)G0049 (Mitre)

Targeted Regions

Bangladesh
BD
Bangladesh
Bangladesh
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
India
IN
India
India
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Iran
IR
Iran
Iran
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Iraq
IQ
Iraq
Iraq
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Israel
IL
Israel
Israel
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Jan 2017 ~ Feb 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
United States
US
United States
United States
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Apr 2016 ~ Jul 2017
Jan 2016Aug 2025

Targeted Sectors

Information TechnologyOil and GasFinancialConsultingAerospaceHealthcare

Recent Indexed Reports

  1. Public
    Mia Ash: Anatomy of a cyber espionage persona, COBALT GYPSY lures middle eastern targets
  2. Public
    COBALT GYPSY's Yet Another PupyRAT-driven Phishing Campaign

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.