Iridium is a threat actor attributed to IR, also known as Sandworm Team, Sandworm, Iron Viking. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Iridium exploit?

Iridium is known to exploit 7 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Iridium

Also known as: Sandworm Team, Sandworm, Iron Viking, CTG-7263, Voodoo Bear, Quedagh, TEMP.Noble, ATK 14, BE2, UAC-0082, UAC-0113, UAC-0125, UAC-0133, FROZENBARENTS, IRIDIUM, Seashell Blizzard, APT 44, Blue Echidna, Grey Tornado, Razing Ursa, G0034, VOODOO BEAR, IRON VIKING, ELECTRUM, TeleBots, APT44, Curly COMrades, BlackEnergy (Group), GRU military unit 74455, Telebots, UNC3810, Hades, Phantom, BlackEnergy Lite

IRInformation theft and espionage

Exploited CVEs

Overview

Iridium is an APT that uses proprietary techniques to bypass two-factor authentication for critical applications, according to security firm Resecurity. A researcher has attributed a recently publicized attack on Citrix’ internal network to the Iranian-linked group known as Iridium – and said that the data heist involved 6 terabytes of sensitive data. The culprit is an APT that uses proprietary techniques to bypass two-factor authentication for critical applications and services for further unauthorized access to virtual private networks and single sign-on systems, according to Resecurity. “[Iridium] has hit more than 200 government agencies, oil and gas companies and technology companies, including Citrix Systems Inc.,” they said. Threatpost has reached out for further details as to how the firm is linking the APT to the attack and will update this post accordingly.

Exploited Vulnerabilities

CVE ID	Action