Actors Insights|Latest update24/07/2026

Newscaster

Named by SymantecSuspected state sponsor: Islamic Republic of Iran

Newscaster is one of the earliest documented names for the Iranian threat cluster now widely known as Charming Kitten. The designation was introduced by iSight Partners (now part of Mandiant) in 2014 to describe an Iranian social media persona operation that used fabricated journalist and news outlet identities to target US military, defense contractors, and government officials for espionage purposes. The Newscaster operation demonstrated Iran's early investment in long-term social engineering infrastructure, a capability that has remained a defining characteristic of the Charming Kitten cluster across more than a decade of operations.

First Seen:Jan 2012
Last Seen:Aug 2025
Indexed Reports:0
Public IOCs:0
Cluster: Charming KittenMitre: Magic HoundMisp: APT35
also known as:
Newscaster Team (Symantec)Magic Hound (Palo Alto)G0059 (Mitre)PHOSPHORUS (Microsoft)Mint Sandstorm (Microsoft)TunnelVision (SentinelOne)COBALT MIRAGE (SecureWorks)Agent SerpensAPT35 (Mandiant)TA453 (Proofpoint)COBALT ILLUSION (SecureWorks)Charming Kitten (CrowdStrike)ITG18 (IBM)

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.