COBALT JUNO is a Middle East-targeted threat actor known for disguising custom spyware as legitimate software.
Analyst brief
COBALT JUNO is a threat actor active since at least 2013, primarily targeting entities in the Middle East, including Iran, Jordan, Egypt, and Lebanon. Their custom spyware families, SABER1 and SABER2, along with the ZooPark Android malware, masquerade as legitimate software like Adobe Updater and feature extensive surveillance functionality. Defenders should monitor for anomalous traffic related to fake software updates and suspicious Android applications, and remain vigilant against social engineering tactics tailored to Middle Eastern targets.
COBALT JUNO
APT-C-38 (QiAnXin)SABER LIONTG-2884 (SCWX CTU)
unknown
COBALT JUNO has operated since at least 2013 and focused on targets located in the Middle East including Iran, Jordan, Egypt & Lebanon. COBALT JUNO custom spyware families SABER1 and SABER2, include surveillance functionality and masquerade as legitimate software utilities such as Adobe Updater, StickyNote and ASKDownloader. CTU researchers assess with moderate confidence that COBALT JUNO operated the ZooPark Android spyware since at least mid-2015. ZooPark was publicly exposed in 2018 in both vendor reporting and a high profile leak of C2 server data. COBALT JUNO is linked to a private security company in Iran and outsources aspects of tool development work to commercial software developers. CTU researchers have observed the group using strategic web compromises to deliver malware. CTU researchers’ discovery of new C2 domains in 2019 suggest the group is still actively performing operations.
Which countries in the Middle East does the COBALT JUNO group target?+
The COBALT JUNO group targets countries in the Middle East, specifically Iran, Jordan, Egypt, and Lebanon.
What legitimate software names does COBALT JUNO spyware masquerade as?+
COBALT JUNO's custom spyware families like SABER1 and SABER2 masquerade as legitimate software names such as Adobe Updater, StickyNote, and ASKDownloader.