Madi
Madi is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 6 sectors, including Government and Manufacturing, in 13 countries, including the United States and Australia.
- Mahdi
- Origin
- Iran
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2011
- Record updated
Who They Target.
About Madi.
Statistics from the sinkhole revealed that the victims were primarily business people working on Iranian and Israeli critical infrastructure projects, Israeli financial institutions, Middle Eastern engineering students, and various government agencies communicating in the Middle East. Common applications and websites that were spied on include accounts on Gmail, Hotmail, Yahoo! Mail, ICQ, Skype, Google+, and Facebook. Surveillance is also performed over integrated ERP/CRM systems, business contracts, and financial management systems.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.