Actors Insights|Latest update24/07/2026

Charming Kitten

Named by CrowdStrikeSuspected state sponsor: Islamic Republic of Iran

Charming Kitten is an Iranian state-sponsored threat actor linked to the Islamic Revolutionary Guard Corps (IRGC) and active since at least 2012. The group conducts cyber espionage operations primarily targeting journalists, academics, political dissidents, think tank researchers, activists, and government officials across the Middle East, Europe, and the United States. Charming Kitten is best known for sustained credential phishing campaigns using fake login pages and social engineering, alongside the exploitation of known vulnerabilities in enterprise software. The cluster is tracked under numerous aliases across the industry including APT35, Magic Hound, Mint Sandstorm, and Phosphorus.

First Seen:Jan 2012
Last Seen:Mar 2026
Indexed Reports:18
Public IOCs:615
Cluster: Charming KittenMitre: Charming KittenMisp: Charming Kitten
also known as:
Newscaster (Symantec)Parastoo (Flashpoint)iKittens (Iran Threats)Group 83 (Talos)NewsBeef (Kaspersky)G0058 (Mitre)CharmingCypress (Volexity)Mint Sandstorm (Microsoft)Charming Kitten (CrowdStrike)

Targeted Regions

Austria
AT
Austria
Austria
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Brazil
BR
Brazil
Brazil
Sep 2023 ~ Sep 2023
Europe
EU
Europe
Europe
Oct 2019 ~ Jan 2020
Oct 2019 ~ Jan 2020
Jul 2020 ~ Jan 2021
Jul 2020 ~ Jan 2021
Jul 2020 ~ Jan 2021
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Apr 2022 ~ Apr 2023
Jan 2022 ~ Sep 2022
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Jun 2024 ~ Oct 2024
Jun 2024 ~ Oct 2024
France
FR
France
France
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jul 2019 ~ Oct 2019
Jan 2015 ~ Sep 2019
Jul 2019 ~ Oct 2019
Jan 2015 ~ Sep 2019
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Germany
DE
Germany
Germany
Jun 2022 ~ Aug 2023
Jun 2022 ~ Aug 2023
Jun 2022 ~ Aug 2023
Jun 2022 ~ Aug 2023
India
IN
India
India
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Iran
IR
Iran
Iran
Jan 2020 ~ Aug 2022
Jan 2020 ~ Aug 2022
Jan 2020 ~ Aug 2022
Jan 2020 ~ Aug 2022
Jan 2022 ~ Sep 2022
Jan 2020 ~ Aug 2022
Jan 2022 ~ Sep 2022
Jan 2020 ~ Aug 2022
Jan 2022 ~ Sep 2022
Jan 2020 ~ Aug 2022
Israel
IL
Israel
Israel
Jul 2018 ~ Jul 2018
Sep 2018 ~ Dec 2018
Jul 2020 ~ Aug 2020
Jul 2020 ~ Aug 2020
Jan 2021 ~ Jun 2023
Jan 2021 ~ Jun 2023
Jan 2022 ~ Sep 2022
Jan 2021 ~ Jun 2023
Jan 2022 ~ Sep 2022
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jan 2022 ~ Sep 2022
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Sep 2023 ~ Sep 2023
Jun 2024 ~ Oct 2024
Jun 2024 ~ Oct 2024
Italy
IT
Italy
Italy
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Middle East
ME
Middle East
Middle East
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jul 2019 ~ Oct 2019
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jul 2019 ~ Oct 2019
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jul 2017 ~ Nov 2022
Jul 2020 ~ Jan 2021
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Jul 2020 ~ Jan 2021
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Jul 2020 ~ Jan 2021
Jan 2022 ~ Sep 2022
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Jan 2022 ~ Sep 2022
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jan 2022 ~ Sep 2022
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Oct 2024 ~ Oct 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Oct 2019 ~ Jan 2020
Oct 2019 ~ Jan 2020
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Turkey
TR
Turkey
Turkey
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Sep 2023 ~ Sep 2023
United Kingdom
GB
United Kingdom
United Kingdom
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Oct 2019 ~ Jan 2020
Oct 2019 ~ Jan 2020
May 2025 ~ Aug 2025
May 2025 ~ Aug 2025
United States
US
United States
United States
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jan 2015 ~ Sep 2019
Jul 2018 ~ Jul 2018
Jul 2017 ~ Nov 2022
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Sep 2018 ~ Dec 2018
Jul 2019 ~ Oct 2019
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Jul 2019 ~ Oct 2019
Jan 2015 ~ Sep 2019
Jul 2017 ~ Nov 2022
Oct 2019 ~ Jan 2020
Jul 2020 ~ Aug 2020
Jul 2017 ~ Nov 2022
Oct 2019 ~ Jan 2020
Jul 2020 ~ Jan 2021
Jul 2020 ~ Aug 2020
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Jul 2020 ~ Jan 2021
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Jul 2020 ~ Jan 2021
Jan 2022 ~ Sep 2022
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Jan 2022 ~ Sep 2022
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jan 2022 ~ Sep 2022
Jul 2017 ~ Nov 2022
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jan 2021 ~ Jun 2023
Apr 2022 ~ Apr 2023
Jun 2024 ~ Oct 2024
Oct 2024 ~ Oct 2024
Jun 2024 ~ Oct 2024
Jan 2015Jul 2026

Targeted Sectors

Human RightsJournalistsResearchersGovernment Agencies and ServicesMediaPoliticalDissidentUniversityInformation TechnologyMilitaryFinancialInsuranceManufacturingProfessional ServiceRetailHealthcareTelecommunicationReligiousCivic

Recent Indexed Reports

  1. Public
    New Charming Kitten Operation Blends Long-Term Reconnaissance and WebSocket Phishing
  2. Public
    BellaCPP: Charming Kitten's Latest Malware Innovation in Asia
  3. Public
    Charming Kitten Targets NGOs and Media with Phishing Attacks via WhatsApp
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.