Cobalt Gypsy

Cobalt Gypsy is Secureworks' designation for the Iranian MOIS-linked threat cluster known as OilRig and APT34. Active since at least 2016, the cluster focuses on espionage against government, energy, and financial organizations in the Middle East, using spear phishing with macro-enabled Office documents and custom backdoors for persistent access. Secureworks' tracking of Cobalt Gypsy aligns closely with Mandiant's APT34 and CrowdStrike's Helix Kitten in terms of infrastructure, tooling, and victim profile, reflecting the same underlying Iranian state espionage operation.