NewsBeef

NewsBeef is an early tracking name used for Charming Kitten campaign activity dating back to at least 2012. The designation was used primarily by Kaspersky and referenced in MITRE ATT&CK to describe Iranian-linked spear phishing and watering hole attacks against Saudi Arabian and Western targets. NewsBeef operations used macro-laden Office documents and social engineering techniques consistent with the broader Charming Kitten tradecraft. The name has since been largely superseded by more widely adopted designations such as APT35, Charming Kitten, and Mint Sandstorm as the cluster's attribution has become better established.