UNC3313

An Iranian espionage cluster with overlap to MuddyWater activity. It targeted government, IT, and telecommunications organizations in the Middle East using phishing and custom malware such as GRAMDOOR and STARWHALE to establish access and collect information.