Cobalt Illusion

Cobalt Illusion is SecureWorks' designation for the Iranian threat cluster known as Charming Kitten, linked to the IRGC. Active since at least 2014, the group is documented targeting think tank employees, policy researchers, and government officials through impersonation of legitimate organizations such as the Atlantic Council. Cobalt Illusion operations typically involve building rapport with targets over extended periods before delivering phishing links or malicious content. The group's consistent focus on high-value individuals with geopolitical expertise aligns with Iranian state intelligence priorities.