Facebook/Meta took action against a previously unreported hacking group from Iran that targeted or spoofed companies in multiple industries around the world. This included energy companies in Saudi Arabia, Canada, Italy, and Russia; the information technology industry in India and United Arab Emirates; the maritime logistics industry in UAE, Iceland, Norway, Saudi Arabia, US, Israel, and India; telecommunications companies in Saudi Arabia and UAE; and the semiconductor industry in Israel, US, and Germany. This group used similar TTPs to another threat actor dubbed Tortoiseshell that we reported on last year, but in this case we saw different targeting, technical infrastructure, and distinct malware.