Helix Kitten

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
Helix Kitten
بچه گربه هلیکس
Formationc. 2004–2007[1]
TypeAdvanced persistent threat
PurposeCyberespionage, cyberwarfare
MethodsZero-days, spearphishing, malware
Official language
Persian
Formerly called
APT34

Helix (also known as APT34 by FireEye, OILRIG) is a hacker group identified by CrowdStrike as Iranian.[1][2]

History[edit]

The group has reportedly been active since at least 2014.[1] It has targeted many of the same organizations as Advanced Persistent Threat 33, according to John Hultquist.[1]

In April 2019, APT34's cyber-espionage tools' source code was leaked through Telegram.[3][4]

Targets[edit]

The group has reportedly targeted organizations in the financial, energy, telecommunications, and chemical industries, as well as critical infrastructure systems.[1]

Techniques[edit]

APT34 reportedly uses Microsoft Excel macros, PowerShell-based exploits and social engineering to gain access to its targets.[1]

References[edit]

  1. ^ a b c d e Newman, Lily Hay (December 7, 2017). "APT 34 Is an Iran-Linked Hacking Group That Probes Critical Infrastructure". Wired. Archived from the original on December 10, 2017.
  2. ^ Sardiwal, Manish; Londhe, Yogesh; Fraser, Nalani; Fraser, Nicholas; O'Leary, Jaqueline; Cannon, Vincent (December 7, 2017). "New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit". FireEye. Archived from the original on December 10, 2017.
  3. ^ Catalin Cimpanu (April 17, 2019). "Source code of Iranian cyber-espionage tools leaked on Telegram; APT34 hacking tools and victim data leaked on a secretive Telegram channel since last month". Retrieved April 24, 2019.
  4. ^ https://www.cyberscoop.com/oilrig-leak-iran-telegram-helix-kitten/