Greenbug

🇮🇷Iran-attributed

campaigns

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors.

Threat Analysis

Greenbug is a known-sophistication threat actor attributed to Iran, engaged in cyber operations with a primary motivation of unknown activity patterns.

Known Campaigns

Greenbug — Active Operations March 2026

Greenbug is a unknown-motivation threat actor attributed to Iran. Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors....

ACTIVEMEDIUM2026

External References

→https://web.archive.org/web/20190331181353/https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon

→https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/

→https://threatpost.com/shamoon-collaborator-greenbug-adopts-new-communication-tool/125383/

→https://www.clearskysec.com/greenbug/

Quick Facts

TypeAPT / Threat Group

Origin🇮🇷 Iran

Aliases1

SourceMalpedia

Also Known As

Greenbug

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Greenbug