Report
Operation Saffron Rose
Jan 14, 2022
1 min read
In this report, we document the activities of the Ajax Security Team, a hacking group believed to be operating from Iran. Members of this group have accounts on popular Iranian hacker forums such as ashiyane[.]org and shabgard[.]org, and they have engaged in website defacements under the group name “AjaxTM” since 2010. By 2014, the Ajax Security Team had transitioned from performing defacements (their last defacement was in December 2013) to malware-based espionage, using a methodology consistent with other advanced persistent threat actors in this region.
Get this paper for insight into multiple cyber-espionage operations against companies in the U.S. defense industrial base and Iranian dissidents.