TA456

TA456 is Proofpoint's designation for the Iranian IRGC-linked threat actor known as Imperial Kitten and Tortoiseshell. Proofpoint documented TA456 conducting long-running social engineering campaigns using romantic-themed fake personas — including fake female identities — to build extended relationships with US defense contractor employees before delivering malware. The group used custom implants delivered via phishing to collect credentials and sensitive information. Proofpoint's research highlighted the actor's investment in persistent, trust-based social engineering as a primary access method.