TLP:CLEAR | CTI Analysts | Updated: March 2026 1. IDENTIFICATION & ATTRIBUTION Naming (known aliases by vendor) The group is tracked under the following names across vendors: APT33 (Mandiant/FireEye, reference designation), Elfin / Elfin Team (Broadcom/Symantec), Refined Kitten (CrowdStrike), Peach Sandstorm (Microsoft, formerly HOLMIUM), MAGNALLIUM (Dragos), COBALT TRINITY (SecureWorks), ATK35, TA451, G0064 (MITRE ATT&CK) (1)(2)(3)(4).…
TLP:CLEAR | General Public | Updated: March 2026 1. IDENTIFICATION & ATTRIBUTION Naming (known aliases by vendor) The group is tracked under the following names across vendors: Handala, Handala Hack, Handala Hack Team, Void Manticore (Check Point Research), Storm-0842 / Storm-842 (Microsoft), BANISHED KITTEN (CrowdStrike), Dune (other vendors) (1)(2). Associated operational personas include Karma (alias…
TLP:CLEAR | Mixed audience | Updated: March 2026 1. IDENTIFICATION & ATTRIBUTION Designations: OilRig (CrowdStrike), Helix Kitten (CrowdStrike), APT34 (Mandiant/Google), IRN2 (SecureWorks), COBALT GYPSY (SecureWorks), Crambus (Symantec), Earth Simnavaz (Trend Micro), EUROPIUM (Microsoft) Origin: Iran Suspected sponsor: Iranian Ministry of Intelligence (MOIS — Vezarat-e Ettela’at va Amniat-e Keshvar) Sophistication level: High (confirmed APT, persistent operations…
On March 13, 2026, Microsoft released out-of-band update KB5084597 to remediate three remote code execution (RCE) vulnerabilities in the RRAS (Routing and Remote Access Service) MMC snap-in: CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. Attack surface and exploitation vector The vulnerability resides in the RRAS MMC snap-in used for remote server management. The attack vector is client-side: the…
Sources: Krebs on Security · BleepingComputer · Cisco TalosReference: Microsoft Security Update Guide, March 2026Target audience: Windows administrators, SOC teams, CERT/CSIRT, patch management leads Overview On March 10, 2026, Microsoft released its monthly Patch Tuesday security updates, addressing 79 vulnerabilities across Windows, Office, SQL Server, Azure, and several third-party components. Three vulnerabilities are classified as…
Classification: TLP:CLEAR Unrestricted public distributionPrimary source: ANSSI CERTFR-2026-CTI-002 March 2026Frameworks: MITRE ATT&CK v16 · Diamond Model · Cyber Kill Chain · CVSS v3.1Regulatory context: NIS2 Directive · Cyber Resilience Act · GDPRSectors covered: Education · Healthcare · Telecom · Local Government · Defense · Cloud · OT/ICS This article is CTI analysis based on the…
