Iran Taps Chafer APT Group amid Civil Aviation Crisis

Symantec reports that Chafer, an Iran-linked APT active since 2015, has been conducting targeted campaigns against airlines, aircraft services, telecoms and maintenance firms across multiple countries to gather maintenance and operational data likely intended to support Iran's civil aviation; the group has shifted from drive-by downloads to spear-phishing, malicious documents, fileless malware, and reuse of open-source tools to evade detection.