🇮🇷

Madi

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As

No alias recorded

Target Countries 15

Countries highlighted in red

Afghanistan Australia Switzerland Ecuador Greece Israel Iraq Islamic Republic of Iran Lebanon Mozambique New Zealand Pakistan Saudi Arabia United States Vietnam

Sectors Targeted

Professional, Scientific, and Technical Services 54 Engineering Public Administration 92 Utilities 22 Educational Services 61 Government Commercial Banking 52211 Oil and gas Financial Private sector National Security and International Affairs 928 Oil and Gas Extraction 211 Telecommunications 517 Think Tanks Finance and Insurance 52 Education

Details

Origin 🇮🇷 IR

Last Updated 01 Jun 2022

MITRE ATT&CK 5

T1059.001 T1071.001 T1105 T1193 T1498.001

Related Zero-Days 1

CVE-2025-0282

Known Names 2 entries

Madi Kaspersky

Mahdi Kaspersky

Observed Target Countries 13

Based on ETDA data — countries highlighted in red

Australia Ecuador Greece Iran Iraq Israel Mozambique New Zealand Pakistan Saudi Arabia Switzerland USA Vietnam

Description

(Kaspersky) Kaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign. Kaspersky Lab and Seculert identified more than 800 victims located in Iran, Israel and select countries across the globe connecting to the C&Cs over the past eight months. Statistics from the sinkhole revealed that the victims were primarily business people working on Iranian and Israeli critical infrastructure projects, Israeli financial institutions, Middle Eastern engineering students, and various government agencies communicating in the Middle East. Common applications and websites that were spied on include accounts on Gmail, Hotmail, Yahoo! Mail, ICQ, Skype, Google+, and Facebook. Surveillance is also performed over integrated ERP/CRM systems, business contracts, and financial management systems.

Tools Used 1

Madi

Operations 1

2012-07 New and Improved Madi Spyware Campaign Continues Madi, the religiously-titled spyware that was discovered last week and thought to be dead, appears to be making a comeback, complete with updates. https://threatpost.com/new-and-improved-madi-spyware-campaign-continues-072512/76849/

Reports & References 3

https://www.symantec.com/connect/blogs/madi-attacks-series-social-engineering-campaigns https://securelist.com/the-madi-campaign-part-i-5/33693/ https://securelist.com/the-madi-campaign-part-ii-53/33701/

ETDA Profile

Madi

Origin

Iran

First Seen 2011

Motivation

Information theft and espionage

View on ETDA APT Groups ↗