GreenFoxtrot

A limited-public-reporting, Iran-aligned tracking cluster observed using commercial hosting and infrastructure patterns associated with Iranian operations. Available public evidence is not sufficient to define a stable toolset, victim profile, or relationship to better-known Iranian groups.