Filter by

Threat profiles

Explore the latest threat group definitions and profiles published by the

Sophos® Counter Threat Unit™ (CTU) Research Team.

Showing 51-60 of 197 profiles

Name	Location	Objectives	Aliases	Tools
COASTLIGHT	Unattributed	Data Theft, Disruption, Espionage	Gonjeshke Darande, Indra, Predatory Sparrow
COBALT AGORA	Iran	Espionage		G0Dx, Ngrok, Procdump, PuTTY, SheepAuthShell, SheepTransportShell, splsvc pipeserver
COBALT AGORA	Iran	Espionage		G0Dx, Ngrok, Procdump, PuTTY, SheepAuthShell, SheepTransportShell, splsvc pipeserver
COBALT AZTEC	Iran	Data Theft, Ransomware	DEV-1084 (Microsoft), GOLD AZTEC, Storm-1084 (Microsoft)	DarkBit ransomware
COBALT DICKENS	Iran	Espionage	ITG22 (IBM), SilentLibrarian (PhishLabs), TA407 (Proofpoint), Yellow Nabu (PwC)
COBALT EDGEWATER	Iran	Espionage	APT34 (FireEye), Cold River (Lastline), DNSpionage (Talos)	AgentDrable, DNSpionage, Karkoff, MailDropper, SideTwist, TWOTONE
COBALT FIRESIDE	Iran	Espionage	Crimson Sandstorm (Microsoft), Cuboid Sandstorm (Microsoft), CURIUM (Microsoft), DEV-0228 (Microsoft), HIVE0095 (IBM), Imperial Kitten (Crowd Strike), TA456 (Proofpoint), Tortoiseshell (Cisco Talos), UNC3890 (Mandiant), Yellow Liderc (PwC)	FireBAK, LEMPO, LiderBird
COBALT FOXGLOVE	Iran	Espionage	Fox Kitten (ClearSky), Lemon Sandstorm (Microsoft), Parisite (Dragos), Pioneer Kitten (Crowdstrike), RUBIDIUM (MIcrosoft), UNC757 (Mandiant)	Chisel, FRP (Fast Reverse Proxy), Mimikatz, n3tw0rm ransomware, ngrok, pay2key ransomware, POWSSHNET, Servo, STSRCheck
COBALT GYPSY	Iran	Espionage	APT34 (FireEye), CHRYSENE (Dragos), Crambus (Symantec), EUROPIUM (Microsoft), Hazel Sandstorm (Microsoft), Helix Kitten (CrowdStrike), ITG13 (IBM), OilRig (ClearSky), Yellow Maero (PwC)	Glimpse, Helminth, Jason, MacDownloader, PoisonFrog, RGDoor, ThreeDollars, TinyZbot, Toxocara, Trichuris, TwoFace
COBALT HICKMAN	Iran	Espionage	APT39 (FireEye), Burgundy Sandstorm (Microsoft), Chafer (Symantec), ITG07 (IBM), Remix Kitten (Crowdstrike)	MechaFlounder, Mimikatz, Remexi, TREKX

…

…