TunnelVision

TunnelVision is a threat tracking name used by SentinelOne for a Charming Kitten subgroup observed exploiting VPN vulnerabilities for initial access in early 2022. The group was documented rapidly exploiting critical flaws in Fortinet FortiOS, Pulse Connect Secure, and VMware Horizon to gain footholds in networks of interest in the Middle East and Europe. TunnelVision activity overlaps technically with the broader Charming Kitten and Mint Sandstorm cluster, sharing targeting patterns and post-exploitation tooling. The operations were noted for speed in weaponizing newly disclosed vulnerabilities, consistent with the technically mature subgroup described by Microsoft under the Mint Sandstorm name.