COBALT JUNO
COBALT JUNO is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Media and Entertainment sector in 7 countries, including Egypt and Iran.
- APT-C-38 (QiAnXin)
- SABER LION
- TG-2884 (SCWX CTU)
- TG-2884
- APT-C-38
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2013
- Record updated
Who They Target.
About COBALT JUNO.
COBALT JUNO has operated since at least 2013 and focused on targets located in the Middle East including Iran, Jordan, Egypt & Lebanon. COBALT JUNO custom spyware families SABER1 and SABER2, include surveillance functionality and masquerade as legitimate software utilities such as Adobe Updater, StickyNote and ASKDownloader. CTU researchers assess with moderate confidence that COBALT JUNO operated the ZooPark Android spyware since at least mid-2015. ZooPark was publicly exposed in 2018 in both vendor reporting and a high profile leak of C2 server data. COBALT JUNO is linked to a private security company in Iran and outsources aspects of tool development work to commercial software developers. CTU researchers have observed the group using strategic web compromises to deliver malware. CTU researchers’ discovery of new C2 domains in 2019 suggest the group is still actively performing operations.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.