ITG18

ITG18 is IBM X-Force's designation for the Iranian threat cluster widely known as Charming Kitten and APT35. Active since at least 2014, the group conducts credential harvesting and espionage operations targeting journalists, NGO workers, US military personnel, and political figures. IBM has documented ITG18's use of elaborately produced phishing videos to train operators on targeting techniques, as well as its extensive use of fake login pages mimicking Google, Microsoft, and Yahoo. The cluster is assessed to operate in support of IRGC intelligence priorities.