Agent Serpens

Agent Serpens is a Unit 42 tracking name for Iranian APT activity assessed with moderate confidence to overlap with APT35 and Charming Kitten, linked to the IRGC. Active since at least 2015, the group is known for sophisticated social engineering and spear phishing campaigns targeting Iranian dissidents, journalists, and activists, particularly those living abroad in Germany and Western Europe. A 2025 campaign documented by Unit 42 involved a fraudulent website impersonating Germany's Mega Model Agency, embedding obfuscated JavaScript to profile visitors via WebRTC IP leaks and canvas fingerprinting. The group's broader toolkit includes custom backdoors such as SnailResin, SlugResin, and Sponsor alongside credential harvesting kits like GCollection. Agent Serpens also incorporates AI-assisted social engineering, including GenAI-enhanced phishing documents, reflecting rapid capability evolution consistent with broader Charming Kitten cluster tradecraft.