IRON HALO

IRON HALO is a cyber espionage group that targets entities of interest to the Russian government, often located in Ukraine and NATO member states. These have included governmental and non-governmental organizations, critical infrastructure providers, telecommunication and technology companies, educational institutions, transportation, media, healthcare, and education.


The group acquires unauthorized access to victim networks via stolen credentials, likely obtained through underground infostealer markets, or through password spray attacks and target spearphishing campaigns. Combined with a collection of open-source tools and custom backdoor malware, IRON HALO steals communications and internal directory information through cloud-based services and email systems. IRON HALO also exploits zero-day vulnerabilities in popular messaging platforms (eg. Zimbra) for intelligence gathering and follow-on social-engineering attacks.


Active since at least April 2024, IRON HALO continues to evolve and improve their tactics, techniques and procedures and poses a threat to organizations that normally fall under the targeting scope of Russian intelligence services.