Researchers found the suspected Iranian group on the same embassy network as Fancy Bear.

The attackers, dubbed "Thrip" by analysts, have reemerged after they seemingly went underground for more than two years.