{ "id": "e649a773-2712-44dd-adab-ba45f2bd2248", "created_at": "2026-04-06T00:19:24.962304Z", "updated_at": "2026-04-10T03:37:36.994737Z", "deleted_at": null, "sha1_hash": "1523675997744275b075a651c99ff350dc845e65", "title": "Helix Kitten", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 77478, "plain_text": "Helix Kitten\r\nBy Contributors to Wikimedia projects\r\nPublished: 2017-12-10 · Archived: 2026-04-05 20:03:02 UTC\r\nFrom Wikipedia, the free encyclopedia\r\nHelix Kitten\r\nبچه گربه هلیکس\r\nFormation c. 2004–2007[1]\r\nType Advanced persistent threat\r\nPurpose Cyberespionage, cyberwarfare\r\nMethods Zero-days, spearphishing, malware\r\nOfficial language Persian\r\nAffiliations APT33\r\nFormerly called APT34\r\nHelix Kitten (also known as APT34 by FireEye, OILRIG, Crambus, Cobalt Gypsy, Hazel Sandstorm,\r\n[1]\r\n or\r\nEUROPIUM)\r\n[2]\r\n is a hacker group identified by CrowdStrike as Iranian.[3][4]\r\nThe group has reportedly been active since at least 2014.[3] It has targeted many of the same organizations as\r\nAdvanced Persistent Threat 33, according to John Hultquist.[3]\r\nIn April 2019, APT34's cyber-espionage tools' source code was leaked through Telegram.\r\n[5][6]\r\nThe group has reportedly targeted organizations in the financial, energy, telecommunications, and chemical\r\nindustries, as well as critical infrastructure systems.[3]\r\nAPT34 reportedly uses Microsoft Excel macros, PowerShell-based exploits and social engineering to gain access\r\nto its targets.[3]\r\n1. ^ \"How Microsoft names threat actors\". Microsoft. Retrieved 21 January 2024.\r\n2. ^ \"Iranian State-Sponsored OilRig Group Deploys 3 New Malware Downloaders\".\r\nhttps://en.wikipedia.org/wiki/Helix_Kitten\r\nPage 1 of 2\n\n3. ^ Jump up to: a\r\n \r\nb\r\n \r\nc\r\n \r\nd\r\n \r\ne\r\n Newman, Lily Hay (December 7, 2017). \"APT 34 Is an Iran-Linked Hacking Group\r\nThat Probes Critical Infrastructure\". Wired. Archived from the original on December 10, 2017.\r\n4. ^ Sardiwal, Manish; Londhe, Yogesh; Fraser, Nalani; Fraser, Nicholas; O'Leary, Jaqueline; Cannon,\r\nVincent (December 7, 2017). \"New Targeted Attack in the Middle East by APT34, a Suspected Iranian\r\nThreat Group, Using CVE-2017-11882 Exploit\". FireEye. Archived from the original on December 10,\r\n2017.\r\n5. ^ Catalin Cimpanu (April 17, 2019). \"Source code of Iranian cyber-espionage tools leaked on Telegram;\r\nAPT34 hacking tools and victim data leaked on a secretive Telegram channel since last month\". ZDNet.\r\nRetrieved April 24, 2019.\r\n6. ^ \"How companies – and the hackers themselves – could respond to the OilRig leak\". 18 April 2019.\r\nSource: https://en.wikipedia.org/wiki/Helix_Kitten\r\nhttps://en.wikipedia.org/wiki/Helix_Kitten\r\nPage 2 of 2\n\n https://en.wikipedia.org/wiki/Helix_Kitten \n3. ^ Jump up to: a b c d e Newman, Lily Hay (December 7, 2017). \"APT 34 Is an Iran-Linked Hacking Group\nThat Probes Critical Infrastructure\". Wired. Archived from the original on December 10, 2017.\n4. ^ Sardiwal, Manish; Londhe, Yogesh; Fraser, Nalani; Fraser, Nicholas; O'Leary, Jaqueline; Cannon,\nVincent (December 7, 2017). \"New Targeted Attack in the Middle East by APT34, a Suspected Iranian\nThreat Group, Using CVe-2017-11882 Exploit\". FireEye. Archived from the original on December 10,\n2017. \n5. ^ Catalin Cimpanu (April 17, 2019). \"Source code of Iranian cyber-espionage tools leaked on Telegram;\nAPT34 hacking tools and victim data leaked on a secretive Telegram channel since last month\". ZDNet.\nRetrieved April 24, 2019. \n6. ^ \"How companies -and the hackers themselves -could respond to the OilRig leak\". 18 April 2019.\nSource: https://en.wikipedia.org/wiki/Helix_Kitten \n Page 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://en.wikipedia.org/wiki/Helix_Kitten" ], "report_names": [ "Helix_Kitten" ], "threat_actors": [ { "id": "ce10c1bd-4467-45f9-af83-28fc88e35ca4", "created_at": "2022-10-25T15:50:23.458833Z", "updated_at": "2026-04-10T02:00:05.419537Z", "deleted_at": null, "main_name": "APT34", "aliases": null, "source_name": "MITRE:APT34", "tools": [ "netstat", "Systeminfo", "PsExec", "SEASHARPEE", "Tasklist", "Mimikatz", "POWRUNER", "certutil" ], "source_id": "MITRE", "reports": null }, { "id": "a63c994f-d7d6-4850-a881-730635798b90", "created_at": "2025-08-07T02:03:24.788883Z", "updated_at": "2026-04-10T02:00:03.785146Z", "deleted_at": null, "main_name": "COBALT TRINITY", "aliases": [ "APT33 ", "Elfin ", "HOLMIUM ", "MAGNALIUM ", "Peach Sandstorm ", "Refined Kitten ", "TA451 " ], "source_name": "Secureworks:COBALT TRINITY", "tools": [ "AutoCore", "Cadlotcorg", "Dello RAT", "FalseFont", "Imminent Monitor", "KDALogger", "Koadic", "NanoCore", "NetWire", "POWERTON", "PoshC2", "Poylog", "PupyRAT", "Schoolbag" ], "source_id": "Secureworks", "reports": null }, { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "cffb3c01-038f-4527-9cfd-57ad5a035c22", "created_at": "2022-10-25T15:50:23.38055Z", "updated_at": "2026-04-10T02:00:05.258283Z", "deleted_at": null, "main_name": "OilRig", "aliases": [ "COBALT GYPSY", "IRN2", "APT34", "Helix Kitten", "Evasive Serpens", "Hazel Sandstorm", "EUROPIUM", "ITG13", "Earth Simnavaz", "Crambus", "TA452" ], "source_name": "MITRE:OilRig", "tools": [ "ISMInjector", "ODAgent", "RDAT", "Systeminfo", "QUADAGENT", "OopsIE", "ngrok", "Tasklist", "certutil", "ZeroCleare", "POWRUNER", "netstat", "Solar", "ipconfig", "LaZagne", "BONDUPDATER", "SideTwist", "OilBooster", "SampleCheck5000", "PsExec", "SEASHARPEE", "Mimikatz", "PowerExchange", "OilCheck", "RGDoor", "ftp" ], "source_id": "MITRE", "reports": null }, { "id": "e5ff825b-0456-4013-b90a-971b93def74a", "created_at": "2022-10-25T15:50:23.824058Z", "updated_at": "2026-04-10T02:00:05.377261Z", "deleted_at": null, "main_name": "APT33", "aliases": [ "APT33", "HOLMIUM", "Elfin", "Peach Sandstorm" ], "source_name": "MITRE:APT33", "tools": [ "PowerSploit", "AutoIt backdoor", "PoshC2", "Mimikatz", "NanoCore", "DEADWOOD", "StoneDrill", "POWERTON", "LaZagne", "TURNEDUP", "NETWIRE", "Pupy", "ftp" ], "source_id": "MITRE", "reports": null }, { "id": "67b2c161-5a04-4e3d-8ce7-cce457a4a17b", "created_at": "2025-08-07T02:03:24.722093Z", "updated_at": "2026-04-10T02:00:03.681914Z", "deleted_at": null, "main_name": "COBALT EDGEWATER", "aliases": [ "APT34 ", "Cold River ", "DNSpionage " ], "source_name": "Secureworks:COBALT EDGEWATER", "tools": [ "AgentDrable", "DNSpionage", "Karkoff", "MailDropper", "SideTwist", "TWOTONE" ], "source_id": "Secureworks", "reports": null }, { "id": "c786e025-c267-40bd-9491-328da70811a5", "created_at": "2025-08-07T02:03:24.736817Z", "updated_at": "2026-04-10T02:00:03.752071Z", "deleted_at": null, "main_name": "COBALT GYPSY", "aliases": [ "APT34 ", "CHRYSENE ", "Crambus ", "EUROPIUM ", "Hazel Sandstorm ", "Helix Kitten ", "ITG13 ", "OilRig ", "Yellow Maero " ], "source_name": "Secureworks:COBALT GYPSY", "tools": [ "Glimpse", "Helminth", "Jason", "MacDownloader", "PoisonFrog", "RGDoor", "ThreeDollars", "TinyZbot", "Toxocara", "Trichuris", "TwoFace" ], "source_id": "Secureworks", "reports": null }, { "id": "b23e717c-0b27-47e0-b3c8-4defe6dd857f", "created_at": "2023-01-06T13:46:38.367369Z", "updated_at": "2026-04-10T02:00:02.945356Z", "deleted_at": null, "main_name": "APT33", "aliases": [ "Elfin", "MAGNALLIUM", "HOLMIUM", "COBALT TRINITY", "G0064", "ATK35", "Peach Sandstorm", "TA451", "APT 33", "Refined Kitten" ], "source_name": "MISPGALAXY:APT33", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "3fff98c9-ad02-401d-9d4b-f78b5b634f31", "created_at": "2023-01-06T13:46:38.376868Z", "updated_at": "2026-04-10T02:00:02.949077Z", "deleted_at": null, "main_name": "Cleaver", "aliases": [ "G0003", "Operation Cleaver", "Op Cleaver", "Tarh Andishan", "Alibaba", "TG-2889", "Cobalt Gypsy" ], "source_name": "MISPGALAXY:Cleaver", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "67709937-2186-4a32-b64c-a5693d40ac77", "created_at": "2023-01-06T13:46:38.495593Z", "updated_at": "2026-04-10T02:00:02.999196Z", "deleted_at": null, "main_name": "OilRig", "aliases": [ "Crambus", "Helix Kitten", "APT34", "IRN2", "ATK40", "G0049", "EUROPIUM", "TA452", "Twisted Kitten", "Cobalt Gypsy", "APT 34", "Evasive Serpens", "Hazel Sandstorm", "Earth Simnavaz" ], "source_name": "MISPGALAXY:OilRig", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b6436f7b-6012-4969-aed1-d440e2e8b238", "created_at": "2022-10-25T16:07:23.91517Z", "updated_at": "2026-04-10T02:00:04.788408Z", "deleted_at": null, "main_name": "OilRig", "aliases": [ "APT 34", "ATK 40", "Chrysene", "Cobalt Gypsy", "Crambus", "DEV-0861", "EUROPIUM", "Earth Simnavaz", "Evasive Serpens", "G0049", "Hazel Sandstorm", "Helix Kitten", "IRN2", "ITG13", "Scarred Manticore", "Storm-0861", "TA452", "Twisted Kitten", "UNC1860", "Yellow Maero" ], "source_name": "ETDA:OilRig", "tools": [ "AMATIAS", "Agent Drable", "Agent Injector", "AgentDrable", "Alma Communicator", "BONDUPDATER", "CACTUSPIPE", "Clayslide", "CypherRat", "DNSExfitrator", "DNSpionage", "DROPSHOT", "DistTrack", "DropperBackdoor", "Fox Panel", "GREYSTUFF", "GoogleDrive RAT", "HighShell", "HyperShell", "ISMAgent", "ISMDoor", "ISMInjector", "Jason", "Karkoff", "LIONTAIL", "LOLBAS", "LOLBins", "LONGWATCH", "LaZagne", "Living off the Land", "MailDropper", "Mimikatz", "MrPerfectInstaller", "OILYFACE", "OopsIE", "POWBAT", "POWRUNER", "Plink", "Poison Frog", "PowerExchange", "PsList", "PuTTY Link", "QUADAGENT", "RDAT", "RGDoor", "SEASHARPEE", "Saitama", "Saitama Backdoor", "Shamoon", "SideTwist", "SpyNote", "SpyNote RAT", "StoneDrill", "TONEDEAF", "TONEDEAF 2.0", "ThreeDollars", "TwoFace", "VALUEVAULT", "Webmask", "WinRAR", "ZEROCLEAR", "ZeroCleare", "certutil", "certutil.exe" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434764, "ts_updated_at": 1775792256, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/1523675997744275b075a651c99ff350dc845e65.pdf", "text": "https://archive.orkl.eu/1523675997744275b075a651c99ff350dc845e65.txt", "img": "https://archive.orkl.eu/1523675997744275b075a651c99ff350dc845e65.jpg" } }