GreenCharlie

GreenCharlie is Recorded Future's designation for an Iranian threat cluster overlapping with APT42, active since at least 2024. The group focuses on credential harvesting and phishing operations targeting US political figures, government officials, and campaign-related organizations — most notably documented during the 2024 US presidential election cycle. GreenCharlie uses typosquatted domains and fake login portals to steal credentials and gain access to email and cloud accounts. The cluster shares infrastructure, tooling, and targeting patterns consistent with the broader APT42 and Mint Sandstorm tracking identities.