apt

Madi / Mahdi

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

MahdiOperation Madi

Attribution

Unclear regional nexus — assessed possibly Iran-linked (low-medium confidence; targets in both Iran and Israel; no MITRE Group ID)

Origin

Unknown

First seen

2011

Last active

2012

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Iran, Israel, regional

Sectors

Government, critical infrastructure, engineering, financial

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iran, Israel, regional (Government, critical infrastructure, engineering sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Rocket KittenactorTechnique overlap
Ferocious KittenactorTechnique overlap
Group5actorTechnique overlap
CadelleactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
Flying KittenactorTechnique overlap
Flame / FlameractorTechnique overlap
Duqu (Duqu 2.0)actorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?