Actors Insights|Latest update29/07/2026

Crambus

Named by SymantecSuspected state sponsor: Islamic Republic of Iran

Crambus is Symantec's designation for the Iranian MOIS-linked threat cluster known as OilRig and APT34. Symantec documented Crambus conducting a prolonged intrusion campaign against government organizations in a Middle Eastern country, maintaining persistent access for approximately eight months and deploying a range of novel backdoors including PowerExchange — a tool that uses Microsoft Exchange email for command and control. Crambus operations documented by Symantec in 2023 demonstrate the group's continued investment in new tooling and its ability to maintain extended access to government networks.

First Seen:Feb 2023
Last Seen:May 2026
Indexed Reports:1
Public IOCs:29
Cluster: OilRigMitre: OilRigMisp: OilRig
also known as:
Twisted Kitten (CrowdStrike)COBALT GYPSY (SecureWorks)Crambus (Symantec)Helix Kitten (CrowdStrike)APT 34IRN2 (Area 1)ATK40 (Thales)G0049 (Mitre)Evasive SerpensHazel Sandstorm (Microsoft)EUROPIUM (Microsoft)TA452 (Proofpoint)Earth Simnavaz (Trend Micro)OilRig (Palo Alto)ITG13 (IBM)

Targeted Regions

Albania
AL
Albania
Albania
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Iraq
IQ
Iraq
Iraq
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Israel
IL
Israel
Israel
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Jordan
JO
Jordan
Jordan
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Kuwait
KW
Kuwait
Kuwait
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Lebanon
LB
Lebanon
Lebanon
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Qatar
QA
Qatar
Qatar
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Turkey
TR
Turkey
Turkey
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
United States
US
United States
United States
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Feb 2023 ~ Oct 2023
Jan 2023Nov 2026

Recent Indexed Reports

  1. Public
    Crambus Unveils New Malware in Multi-Stage, Multi-Tool Cyber Attack

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.