Helix Kitten — Threat Actor Profile, Campaigns & Targets

Related Threat Clusters

• OilRig Uses LSB Steganography to Conceal C2 Configurations in Google Drive Images

  The Iranian APT group OilRig, also known as APT34 and Helix Kitten, has launched a new attack campaign utilizing LSB (Least Significant Bit) steganography to hide command-and-control (C2) configurations within PNG…

  2 articles · Updated April 28, 2026
• Data Breach Exposes Iranian Cybersecurity Academy's Student Information

  The Ravin Academy, a training institution for Iranian state hackers, experienced a data breach that revealed the personal information of over 1,000 individuals associated with the academy. The leak was made public by…

  2 articles · Updated October 30, 2025
• Data Leak Exposes Iranian Cybersecurity Academy Trainees

  The Ravin Academy, a training institution for Iranian state hackers, experienced a data breach that revealed the identities of over 1,000 individuals associated with the academy. The leak was publicized by…

  2 articles · Updated October 30, 2025

Recent Intelligence Reports

• OilRig Hides C2 Configuration in Google Drive Image Using LSB Steganography — Cybersecuritynews · April 28, 2026
• OilRig Hides C2 Config in Google Drive Image via LSB Steganography — Gbhackers · April 28, 2026
• Data Leak Outs Hacker Students of Iran's MOIS Training Academy — Darkreading · October 30, 2025

Related Entities