COBALT JUNO is a state-sponsored cyber espionage group assessed with moderate confidence to be linked to a private security company in Iran, first documented as active in 2013. This group's primary motivation is to disrupt operations and exfiltrate sensitive data from targeted entities. They distinguish themselves through the development and deployment of custom spyware families, such as SABER1 and SABER2, which are designed for surveillance and often masquerade as legitimate software utilities like Adobe Updater, StickyNote, and ASKDownloader. COBALT JUNO also operated the ZooPark Android spyware. The group outsources aspects of its tool development to commercial software developers and has been observed using strategic web compromises to deliver malware. This actor is known by several aliases, including APT-C-38, SABER LION, and TG-2884, and should not be confused with other similarly named groups such as COBALT GROUP, COBALT SHADOW, or COBALT MIRAGE, which exhibit different motivati

Aliases del actor

APT-C-38 (QiAnXin)SABER LIONTG-2884 (SCWX CTU)

Actores similares

apt-silencerlionactor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1apt-30actor · 1apt-38actor · 1