APT34 is a threat group linked to Iran and associated with malware, credential theft, and cyberespionage against organizations.
Search across headline titles and summaries.
Background for this topic.
APT34 is a cyber espionage group linked to Iranian state interests, primarily targeting organizations across the Middle East. They focus on sectors such as energy, telecommunications, financial services, and government entities. Their attacks often begin with spear-phishing emails containing malicious attachments or links, leading to credential theft, network reconnaissance, and deployment of custom malware to maintain persistent access.
Security teams should watch for phishing campaigns tailored to regional or industry-specific contexts and monitor for unusual authentication patterns or lateral movement within networks. Defenses include enforcing multi-factor authentication, promptly patching vulnerabilities, and using threat intelligence to identify APT34’s known malware signatures and command-and-control infrastructure. Understanding their targeting helps organizations prioritize protections around critical infrastructure and sensitive data in high-risk regions.
Weekly headline count for the current query.
The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region
Iraqi government networks have emerged as the target of an "elaborate" cyber attack campaign orchestrated by an Iran state-sponsored threat actor called OilRig
The Iranian state-sponsored threat actor known as OilRig deployed three different downloader malware throughout 2022 to maintain persistent access to victim organizations located in Israel
The Iran-linked OilRig threat actor targeted an unnamed Middle East government between February and September 2023 as part of an eight-month-long campaign
Sophisticated cyber actors backed by Iran known as OilRig have been linked to a spear-phishing campaign that infects victims with a new strain of malware called Menorah
Israeli organizations were targeted as part of two different campaigns orchestrated by the Iranian nation-state actor known as OilRig in 2021 and 2022
The Iranian threat actor tracked as APT34 has been linked to a new phishing attack that leads to the deployment of a variant of a backdoor called SideTwist
The Iranian nation-state hacking group known as OilRig has continued to target government organizations in the Middle East as part of a cyber espionage campaign that leverages a new backdoor to exfiltrate data