The Secureworks Counter Threat Unit (CTU) researchers are investigating attacks by the Iranian COBALT MIRAGE threat group, which has been operating since at least June 2020. Linked to the Iranian COBALT ILLUSION threat group, COBALT MIRAGE uses persistent phishing campaigns to gain access.