Cybersecurity researchers have published reports showing that throughout 2022, OilRig (an Iranian state-sponsored threat actor also known as APT34, Crambus, Cobalt Gypsy, Hazel Sandstorm, and Helix Kitten).
The prolific APT repeatedly compromised targets in healthcare, manufacturing, and government with new lightweight downloaders that blend into network traffic for evasion.