Charming Kitten Cluster
Suspected state sponsor: Islamic Republic of IranCharming Kitten is one of Iran's most prolific and long-running cyber espionage clusters, assessed with high confidence to operate under the Islamic Revolutionary Guard Corps (IRGC). Active since at least 2012, the group has conducted sustained operations against a wide range of targets including journalists, academics, political dissidents, human rights activists, think tank researchers, defense industry employees, and government officials. Its geographic focus spans the Middle East, Europe, and the United States, with particular emphasis on individuals perceived as threats to the Iranian regime.
Targets and Goals
Charming Kitten's mission is primarily intelligence collection in support of IRGC priorities. Targets are carefully selected and include people with access to geopolitical intelligence, policy research, and sensitive communications. The group has repeatedly targeted Western and Israeli officials, Iranian diaspora communities, and individuals involved in Iran nuclear policy discussions. Microsoft noted the cluster also targets political dissidents and protest leaders inside and outside Iran.
Tooling and Tactics
Charming Kitten relies heavily on spear phishing and social engineering. Common techniques include sending fake SMS and email messages impersonating Google, Microsoft, or Yahoo account alerts to redirect targets to credential harvesting pages. The group weaponizes legitimate services like Google Sites and Google Scripts to obscure phishing infrastructure. In parallel, a technically sophisticated subgroup exploits N-day vulnerabilities in enterprise software — including Log4Shell, ProxyShell, and Fortinet FortiOS flaws — to gain direct access to target environments. Post-compromise tooling includes custom backdoors, PowerShell-based implants, and keyloggers. In select campaigns the group has targeted critical infrastructure including energy and transportation sectors.
Aliases
The cluster is tracked under many names: APT35 (Mandiant/FireEye), Magic Hound (Palo Alto), Phosphorus and Mint Sandstorm (Microsoft), NewsBeef and Newscaster (early campaigns), Ballistic Bobcat (ESET), Educated Manticore (Check Point), CharmingCypress (Volexity), Cobalt Illusion (SecureWorks), iKittens (FireEye legacy), ITG18 (IBM X-Force), and Yellow Garuda (PwC). Despite the proliferation of names, the underlying actor and IRGC affiliation are consistently assessed across vendors.
observatory results
APT35
APT35 is named by Mandiant and at the moment 7 indexed report with 74 related IOCs
Ballistic Bobcat
Ballistic Bobcat is named by ESET and at the moment 1 indexed report with 19 related IOCs
CharmingCypress
CharmingCypress is named by Volexity and at the moment 1 indexed report with 108 related IOCs
Charming Kitten
Charming Kitten is named by CrowdStrike and at the moment 18 indexed report with 615 related IOCs
Cobalt Illusion
Cobalt Illusion is named by SecureWorks and at the moment 1 indexed report with 16 related IOCs
Educated Manticore
Educated Manticore is named by Check Point and at the moment 2 indexed report with 166 related IOCs
iKittens
iKittens is named by Iran Threats and at the moment 1 indexed report with 6 related IOCs
ITG18
ITG18 is named by IBM and at the moment 1 indexed report with 0 related IOCs
Magic Hound
Magic Hound is named by Palo Alto and at the moment 1 indexed report with 80 related IOCs
Mint Sandstorm
Mint Sandstorm is named by Microsoft and at the moment 10 indexed report with 137 related IOCs
NewsBeef
NewsBeef is named by Kaspersky and at the moment 2 indexed report with 67 related IOCs
Newscaster
Newscaster is named by Symantec and at the moment 0 indexed report with 0 related IOCs
Phosphorus
Phosphorus is named by Microsoft and at the moment 10 indexed report with 137 related IOCs
TunnelVision
TunnelVision is named by SentinelOne and at the moment 2 indexed report with 21 related IOCs
Yellow Garuda
Yellow Garuda is named by PWC and at the moment 1 indexed report with 96 related IOCs
Most Common Tactics
Targeted Regions
AfghanistanAfghanistan
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
AlgeriaAlgeria
Feb 2016 ~ Apr 2016
AustriaAustria
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
BelgiumBelgium
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
BrazilBrazil
Feb 2016 ~ Apr 2016
Mar 2021 ~ Sep 2023
Mar 2021 ~ Sep 2023
Mar 2021 ~ Sep 2023
Mar 2021 ~ Sep 2023
Sep 2023 ~ Sep 2023 Mar 2021 ~ Sep 2023
ChinaChina
Feb 2016 ~ Apr 2016
EuropeEurope
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017 Jan 2014 ~ Mar 2025
Jan 2012 ~ Mar 2017 Jan 2014 ~ Mar 2025
Jan 2012 ~ Mar 2017 Jan 2014 ~ Mar 2025
Feb 2016 ~ Apr 2016 Jan 2012 ~ Mar 2017 Jan 2014 ~ Mar 2025
Jan 2012 ~ Mar 2017 Jan 2014 ~ Mar 2025
Jan 2012 ~ Mar 2017 Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025 Oct 2019 ~ Jan 2020
Jan 2014 ~ Mar 2025 Sep 2020 ~ Oct 2020 Jul 2020 ~ Jan 2021
Jan 2014 ~ Mar 2025 Jan 2021 ~ Oct 2021 Sep 2020 ~ Oct 2020 Jul 2020 ~ Jan 2021
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Dec 2021 ~ Aug 2023 Jan 2021 ~ Oct 2021 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Dec 2021 ~ Aug 2023 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jan 2023 ~ Mar 2023 Dec 2021 ~ Aug 2023 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Dec 2021 ~ Aug 2023 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jun 2024 ~ Oct 2024
Jan 2014 ~ Mar 2025 Jun 2024 ~ Oct 2024
Jan 2014 ~ Mar 2025
FranceFrance
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jul 2019 ~ Oct 2019 Jan 2015 ~ Sep 2019
Jul 2019 ~ Oct 2019 Jan 2015 ~ Sep 2019
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Jan 2022 ~ Sep 2022
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
GermanyGermany
Feb 2016 ~ Apr 2016
Jun 2022 ~ Aug 2023
Jun 2022 ~ Aug 2023
Jun 2022 ~ Aug 2023
GreeceGreece
Apr 2020 ~ Jul 2020
IndiaIndia
Feb 2016 ~ Apr 2016
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
IranIran
Feb 2016 ~ Apr 2016
Jan 2020 ~ Aug 2022
Jan 2020 ~ Aug 2022
Jan 2021 ~ Oct 2021 Jan 2021 ~ Jul 2022 Jan 2020 ~ Aug 2022
Jan 2022 ~ Sep 2022 Jan 2021 ~ Oct 2021 Jan 2021 ~ Jul 2022 Jan 2020 ~ Aug 2022
Apr 2022 ~ Nov 2025 Jan 2022 ~ Sep 2022 Jan 2021 ~ Jul 2022 Jan 2020 ~ Aug 2022
Apr 2022 ~ Nov 2025 Jan 2022 ~ Sep 2022 Jan 2023 ~ Mar 2023
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
IsraelIsrael
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025 Jul 2018 ~ Jul 2018 Sep 2018 ~ Dec 2018
Jan 2014 ~ Mar 2025 Sep 2018 ~ Dec 2018
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025 Jul 2020 ~ Aug 2020
Jan 2014 ~ Mar 2025 Mar 2021 ~ Sep 2023 Jan 2021 ~ Jun 2023
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Mar 2021 ~ Sep 2023 Jan 2021 ~ Jun 2023 Sep 2021 ~ Apr 2023 Nov 2021 ~ Jan 2022
Apr 2022 ~ Nov 2025 Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jun 2022 ~ Jun 2022 Mar 2021 ~ Sep 2023 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Apr 2022 ~ Nov 2025 Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Mar 2021 ~ Sep 2023 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023 Apr 2023 ~ Apr 2023 Sep 2021 ~ Apr 2023
Apr 2022 ~ Nov 2025 Jan 2014 ~ Mar 2025 Sep 2023 ~ Sep 2023 Nov 2023 ~ Jan 2024 Mar 2021 ~ Sep 2023 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023 Apr 2023 ~ Apr 2023 Sep 2021 ~ Apr 2023
Apr 2022 ~ Nov 2025 Jan 2014 ~ Mar 2025 Jan 2024 ~ Nov 2024 Jun 2024 ~ Oct 2024 Nov 2023 ~ Jan 2024
Apr 2022 ~ Nov 2025 Jan 2025 ~ Jun 2025 Jan 2014 ~ Mar 2025 Jan 2024 ~ Nov 2024 Jun 2024 ~ Oct 2024
Apr 2022 ~ Nov 2025 Jan 2025 ~ Jun 2025 Jan 2014 ~ Mar 2025
Apr 2022 ~ Nov 2025
ItalyItaly
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
Apr 2022 ~ Apr 2023
JapanJapan
Feb 2016 ~ Apr 2016
JordanJordan
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
KazakhstanKazakhstan
Feb 2016 ~ Apr 2016
KuwaitKuwait
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
LebanonLebanon
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Middle EastMiddle East
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022
Jan 2014 ~ Mar 2025 Jul 2019 ~ Oct 2019 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022
Jan 2014 ~ Mar 2025 Jul 2019 ~ Oct 2019 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022
Jan 2014 ~ Mar 2025 Jul 2017 ~ Nov 2022 Sep 2020 ~ Oct 2020 Jul 2020 ~ Jan 2021
Jan 2014 ~ Mar 2025 Jul 2017 ~ Nov 2022 Jan 2021 ~ Jun 2023 Jan 2021 ~ Oct 2021 Sep 2020 ~ Oct 2020 Jul 2020 ~ Jan 2021
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jul 2017 ~ Nov 2022 Dec 2021 ~ Aug 2023 Jan 2021 ~ Jun 2023 Jan 2021 ~ Oct 2021
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jul 2017 ~ Nov 2022 Feb 2022 ~ Feb 2022 Dec 2021 ~ Aug 2023 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jul 2017 ~ Nov 2022 Dec 2021 ~ Aug 2023 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023
Jan 2014 ~ Mar 2025 Dec 2021 ~ Aug 2023 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025 Oct 2024 ~ Oct 2024
Jan 2014 ~ Mar 2025
PalestinePalestine
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
QatarQatar
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
RomaniaRomania
Feb 2016 ~ Apr 2016
RussiaRussia
Feb 2016 ~ Apr 2016
Saudi ArabiaSaudi Arabia
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017
Jan 2012 ~ Mar 2017 May 2016 ~ Feb 2017
Jan 2012 ~ Mar 2017 May 2016 ~ Feb 2017
Jan 2012 ~ Mar 2017 May 2016 ~ Feb 2017
Oct 2019 ~ Jan 2020
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Jan 2022 ~ Sep 2022
Apr 2022 ~ Nov 2025 Jan 2022 ~ Sep 2022
Apr 2022 ~ Nov 2025 Jan 2022 ~ Sep 2022
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
South KoreaSouth Korea
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
ThailandThailand
Jan 2024 ~ Nov 2024
Jan 2024 ~ Nov 2024
TurkeyTurkey
Feb 2016 ~ Apr 2016
Jan 2021 ~ Jul 2022
Jan 2021 ~ Jul 2022
Apr 2022 ~ Nov 2025 Jan 2021 ~ Jul 2022 Apr 2022 ~ Apr 2023
Apr 2022 ~ Nov 2025 Apr 2022 ~ Apr 2023
Apr 2022 ~ Nov 2025 Apr 2022 ~ Apr 2023
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
United Arab EmiratesUnited Arab Emirates
Mar 2021 ~ Sep 2023
Mar 2021 ~ Sep 2023
Apr 2022 ~ Nov 2025 Mar 2021 ~ Sep 2023
Apr 2022 ~ Nov 2025 Mar 2021 ~ Sep 2023
Apr 2022 ~ Nov 2025 Sep 2023 ~ Sep 2023 Mar 2021 ~ Sep 2023
Apr 2022 ~ Nov 2025 Jan 2024 ~ Nov 2024
Apr 2022 ~ Nov 2025 Jan 2024 ~ Nov 2024
Apr 2022 ~ Nov 2025
Apr 2022 ~ Nov 2025
United KingdomUnited Kingdom
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Feb 2016 ~ Apr 2016 Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019
Jan 2015 ~ Sep 2019 Oct 2019 ~ Jan 2020
Jan 2021 ~ Oct 2021
Jan 2021 ~ Oct 2021
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
May 2025 ~ Aug 2025
United StatesUnited States
Jan 2014 ~ Mar 2025
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Oct 2016 ~ Feb 2017
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022 Oct 2016 ~ Feb 2017
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022
Jan 2014 ~ Mar 2025 Jan 2015 ~ Sep 2019 Jul 2018 ~ Jul 2018 Jul 2017 ~ Nov 2022 Sep 2018 ~ Dec 2018
Jan 2014 ~ Mar 2025 Jul 2019 ~ Oct 2019 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022 Sep 2018 ~ Dec 2018
Jan 2014 ~ Mar 2025 Jul 2019 ~ Oct 2019 Jan 2015 ~ Sep 2019 Jul 2017 ~ Nov 2022 Oct 2019 ~ Jan 2020
Jan 2014 ~ Mar 2025 Jul 2020 ~ Aug 2020 Jul 2017 ~ Nov 2022 Apr 2020 ~ Jul 2020 Sep 2020 ~ Oct 2020 Jul 2020 ~ Jan 2021
Jan 2014 ~ Mar 2025 Jul 2017 ~ Nov 2022 Jan 2021 ~ Jun 2023 Sep 2020 ~ Oct 2020 Jan 2021 ~ Jul 2022 Jul 2020 ~ Jan 2021
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jul 2017 ~ Nov 2022 Jan 2021 ~ Jun 2023 Jan 2021 ~ Jul 2022 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jun 2022 ~ Jun 2022 Jul 2017 ~ Nov 2022 Feb 2022 ~ Feb 2022 Jan 2021 ~ Jun 2023 May 2022 ~ Jun 2022 Jan 2021 ~ Jul 2022 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jan 2022 ~ Sep 2022 Jan 2023 ~ Mar 2023 Jul 2017 ~ Nov 2022 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Nov 2023 ~ Jan 2024 Jan 2021 ~ Jun 2023 Apr 2022 ~ Apr 2023 Sep 2021 ~ Apr 2023
Jan 2014 ~ Mar 2025 Jan 2024 ~ Nov 2024 Jun 2024 ~ Oct 2024 Nov 2023 ~ Jan 2024
Jan 2014 ~ Mar 2025 Jan 2024 ~ Nov 2024 Oct 2024 ~ Oct 2024 Jun 2024 ~ Oct 2024
Jan 2014 ~ Mar 2025
Recent Activities
Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.