Secureworks Counter Threat Unit researchers discovered a campaign that has been running since at least June 2020 and have attributed the activity to the “Cobalt Mirage” threat group. The Cobalt Mirage group is an Iranian state-sponsored threat actor that has close ties to the “Cobalt Illusion,” “Phosphorous,” and “TunnelVision” APTs. The threat group targets organizations in Israel, the U.S., Europe, and Australia. The researchers have broken down the Cobalt Mirage operation into two (2) distinct clusters. Cluster A has been found to use BitLocker and DiskCryptor to “conduct opportunistic ransomware attacks for financial gain,” while Cluster B “focuses on targeted intrusions to gain access and collect intelligence, but some of the activity has experimented with ransomware.” Both clusters have been known to conduct “scan-and-exploit,” activity, exploiting known vulnerabilities in applications such as Fortinet FortiOS and Microsoft Exchange, as well as the ProxyShell vulnerability. In their most recent attacks at the beginning of 2022, the threat actors used access they obtained through exploiting the ProxyShell vulnerability to target a U.S. philanthropic organization. During the attack, Cobalt Mirage deployed custom malware based on the Fast Reverse Proxy application, a well-known tool used for directly connecting to devices behind a firewall. The threat actors then used a Local Security Authority Server Service (LSASS) credential dump to pivot across the network. Finally, BitLocker was deployed on three (3) workstations and a ransom note was sent to a local printer with a contact email address and Telegram account. In March 2022, Cluster B used techniques similar to those used on the philanthropic organization to target a U.S. local government network, but instead focused on exfiltrating data rather than deploying ransomware. Due to the threat group’s technique of remaining dormant for months at a time, CTIX analysts recommend all organizations scan their network for indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) relating to the Cobalt Mirage APT.