SOLAR ION

Reported Context (13)

Public reporting cited by the vulnerability table attributed exploitation of CVE-2026-1281 to this actor. CYFIRMA Report Maps Cyber Threats Facing India and SAARC Telecom Sector
Iran-linked espionage actor explicitly identified as OilRig. All three Q3 campaigns in its profile are shared; one contains only North Korean tooling and is excluded from its technique assessment. CYFIRMA Q3 2026 Report Tracks 48 APT Campaigns, Persistent Backdoors and Edge-Device Exploitation
Previously used name mapped to the new name SOLAR ION. Google Threat Intelligence Group Introduces Unified Threat Actor Naming System
Associated with persistent regional espionage, commonly linked in the article to MOIS; previously documented activity targeted Iraqi government infrastructure. Midyear Assessment Finds Iran-Linked Cyber Risk Centered on Persistent Access and Trusted Pathways
Reportedly used compromised Iraqi government infrastructure for phishing against another Middle Eastern government; explicitly also called TA402 and OilRig, with Dust Specter overlapping its TAG-135 subcluster. Report: AI Is Scaling Iran’s Cyber and Influence Operations, Not Transforming Its Playbook

CVE (18)

Malware (46)

People (15)

Threat Actors (128)

MITRE ATT&CK (57)

Vendors (37)

Products (75)

Tools (21)

Industries (46)

Countries (36)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.