216.73.217.22

Multiple Iranian APT groups

· Published 04/03/2026 16:46 · Modified 04/03/2026 16:46 · Source: AlienVault

Essential information

Confidence
100/100
Published
04/03/2026 16:46
Modified
04/03/2026 16:46
Updated at
04/03/2026 16:46
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 20 attack patterns (mitre), 10 malware, 7 sectors, 6 countries, 2 indicators, 1 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (20)

  • T1486 uses
    Data Encrypted for Impact
  • T1190 uses
    Exploit Public-Facing Application
  • T1133 uses
    External Remote Services
  • T1498 uses
    Network Denial of Service
  • T1566 uses
    Phishing
  • T1498.001 uses
    Direct Network Flood
  • T1189 uses
    Drive-by Compromise
  • T1498.002 uses
    Reflection Amplification
  • T1595 uses
    Active Scanning
  • T1587 uses
    Develop Capabilities
  • Password Spraying uses
    T1110.003
  • T1561.002 uses
    Disk Structure Wipe
  • T1561 uses
    Disk Wipe
  • T1110 uses
    Brute Force
  • T1566.002 uses
    Spearphishing Link
  • T1078 uses
    Valid Accounts
  • T1490 uses
    Inhibit System Recovery
  • T1566.001 uses
    Spearphishing Attachment
  • T1588 uses
    Obtain Capabilities
  • T1590 uses
    Gather Victim Network Information

Malware (10)

  • Filerase uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • ZeroCleare - S1151 uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • GhostFetch uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • Tickler uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • Shamoon
  • ZeroCleare uses
    Family The MITRE Corporation Confidence 100

    [ZeroCleare](https://attack.mitre.org/software/S1151) is a wiper malware that has been used in conjunction with the [RawDisk](https://attack.mitre.org/software/S0364) driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:37 · Modified 27/03/2026 01:05
  • SHAPESHIFT uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • Shamoon - S0140 uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • IOCONTROL uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • RustyWater uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30

Sectors (7)

  • Finance targets
  • Government targets
  • Telecommunications targets
  • Healthcare targets
  • Aerospace targets
  • Defense targets
  • Energy targets

Countries (6)

  • United States of America targets
  • Saudi Arabia targets
  • United Arab Emirates targets
  • Kuwait targets
  • Israel targets
  • Jordan targets

Indicators (2)

Vulnerabilities (CVE) (1)

CVE-2024-24919 KEV
8.6 High

Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways …

Attack vector
Network
Published
30/05/2024
Modified
04/03/2026
Received