Educated Manticore

Educated Manticore is Check Point Research's designation for a Charming Kitten subgroup active since at least 2023. The group targets Israeli government and defense-adjacent organizations using improved infection chains that include both Windows and macOS malware. Educated Manticore has been documented using malicious ISO images and PowerShell-based implants in campaigns showing increased technical sophistication compared to earlier Charming Kitten operations. The subgroup's targeting of Israeli entities is consistent with IRGC operational priorities documented across the broader cluster.