Sima is a state-sponsored threat group of Iranian origin, first documented in February 2016. The group's primary motivation is information theft and espionage, distinguishing itself through highly refined spear-phishing tactics that incorporate detailed background research and legitimate-looking baits to increase success rates. Sima has demonstrated an evolution in its social engineering techniques, using malware binaries disguised with right-to-left filenames to conceal actual file extensions and appropriating real identities to interact professionally with targets. This approach represents a notable refinement compared to other groups that rely on more generic attack methods.

Aliases del actor

IMAPLoaderAPT MINIDUKEAPT TICKapolloshadowatg26blue pythonkazuarkyptonsnakestorm-0156uroburosvenomous bearwainscotwaterbug

Actores similares

apt-blueprintactor · 1apt-minidukeactor · 1apt-noisybearactor · 1apt-tickactor · 1APT29 (Cozy Bear)actor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0apt-45actor · 2