IranAssessedIranEspionageActive 2018 – 2019DNSpionage
Also known asCOBALT EDGEWATER
Summary
Espionage cluster that Cisco Talos named in November 2018 after its DNSpionage remote-access tool, which talks to its operators over HTTP and DNS tunnelling (T1071.004). Talos found it targeting Lebanon and the UAE, affecting .gov domains and a private Lebanese airline, through fake job-posting websites and macro-laden Office documents (T1204.002) that dropped the tool under a scheduled task (T1053.005); Talos does not know how the documents reached victims, and judges email spear-phishing most likely, with LinkedIn possible. The same operators redirected the DNS of legitimate .gov and private domains and generated Let's Encrypt certificates for each redirected domain (T1584.002, T1588.004). In 2019 Talos saw a new reconnaissance stage that chose which victims received malware, and a new .NET backdoor, Karkoff; it rated the link to OilRig, from that April's leak, as weak. Sophos CTU, which tracks the cluster as COBALT EDGEWATER, assesses with moderate confidence that it operates on behalf of Iran, focused on Lebanon and the UAE. Sophos lists "Cold River (Lastline)" among its aliases; that 2019 name is not used here, because it collides with the unrelated Russian COLDRIVER.
Attribution
Single vendor (Sophos CTU, moderate); Talos does not attribute and calls the OilRig link weak
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Sophos CTU (Research, 2026-10)
Operates on behalf of Iran (moderate confidence)
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Selective-infection reconnaissance stage and Karkoff backdoor | 2019-02 – 2019-04 | Lebanon | Undisclosed | Cisco Talos (2019-04-23) |
| Fake job sites and DNS redirection against Lebanese and UAE .gov domains and a Lebanese airline | 2018 – 2018-11 | Lebanon, UAE | Government, Aviation | Cisco Talos (2018-11-27) — end is the publication month |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Resource Development2 | T1584.002DNS ServerT1588.004Digital Certificates |
|---|---|
| Execution1 | T1204.002Malicious File |
| Persistence1 | T1053.005Scheduled Task |
| Command and Control1 | T1071.004DNS |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| DNSpionage | RAT (HTTP / DNS tunnelling) | Windows |
| Karkoff | Backdoor (.NET) | Windows |
Infrastructure patterns
- Fake job-posting sites (hr-wipro[.]com, hr-suncor[.]com) serving macro documents (Talos, 2018)
- DNS redirection of .gov and private domains, with a Let's Encrypt cert per domain (Talos, 2018)
Reporting and advisories 3
- Cisco Talos
DNSpionage campaign targets Middle East (Nov 2018) - Cisco Talos
DNSpionage brings out the Karkoff (Apr 2019) - Sophos CTU
COBALT EDGEWATER threat profile