COBALT KATANA is an Iranian-linked threat actor assessed with moderate confidence to operate on behalf of Iran, active since at least March 2018. The group primarily conducts cyber-espionage and financial theft operations, with a notable focus on organizations based in or associated with Kuwait, specifically targeting government, logistics, and shipping entities. COBALT KATANA is distinguished by its use of a custom platform known as the Sakabota Framework, which includes a suite of modular backdoors and accessory tools. The group's primary motivation encompasses both financial gain and strategic espionage objectives. While operating under the name COBALT KATANA, it is also known by aliases such as Hunter Serpens, and has demonstrated evolving tactics, including a shift towards fileless malware techniques and the exploitation of zero-day vulnerabilities.

Aliases del actor

Hive0081Hunter SerpensSectorD01xHunt campaign

Actores similares

huntersransomware · 307shinyhuntersransomware · 87malwrhunterteamactor · 11crazyhunterransomware · 2Scattered Lapsus$ Huntersthreat-actor · 1cobalt-dickensactor · 1Huntersransomware · 1Cobalt Groupactor · 1cobalt-spideractor · 1Cobaltapt · 0