Security researchers discovered cyber espionage operation dubbed Magic Hound campaign that is linked to Iran and the recent Shamoon 2 attacks. Hackers targeted organizations in the energy, government, and technology industries, all the targets are located or have an interest in Saudi Arabia. The same campaign was also monitored by experts at SecureWorks that attributed it to a threat actor tracked as COBALT GYPSY that is associated with the Iranian government. The bait files appear to be holiday greeting cards, job offers, and official government documents from the Ministry of Health and Ministry of Commerce.”]
Source: https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html