RICH ION

Reported Context (13)

Previously used name mapped to the new name RICH ION. Google Threat Intelligence Group Introduces Unified Threat Actor Naming System
Iran-linked threat actor described as operating credential-phishing campaigns and the infrastructure associated with Moses Staff. Leaked APT35 Records Link Infrastructure Procurement to Moses Staff Operations
The article attributes it to the IRGC Intelligence Organization and reports pre-positioned access across Jordan, UAE, Saudi Arabia, and Kuwait. The article identifies Charming Kitten, Phosphorus, Mint Sandstorm, and Magic Hound as alternate names. CloudSek Report Warns of Iranian-Linked Cyber Pre-Positioning Across Gulf Networks
Iranian state-sponsored group described as having historically pre-positioned inside target networks. CloudSEK Warns Exposed MLOps Platforms Could Enable AI Pipeline Sabotage
Identified by the report as an Iranian state-sponsored group with pre-positioned infrastructure that may be activated against US-aligned targets and regional sectors. Briefing Warns Iran-Israel War Could Raise Cyber Risks Across Southeast Asia

CVE (9)

Malware (32)

People (14)

Threat Actors (84)

MITRE ATT&CK (80)

Vendors (41)

Products (72)

Tools (36)

Industries (39)

Countries (36)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.