Threats Feed

Leaked internal documents reveal a highly structured APT35 (Charming Kitten) operation run as a quota-driven, bureaucratic intelligence unit within the IRGC IO. The materials detail coordinated, long-term cyber-espionage campaigns targeting Lebanon, Kuwait, Turkey, Saudi Arabia, South Korea, and domestic Iranian entities, with a strong focus on diplomatic, governmental, telecom, energy, and large commercial mail systems. Operators used ProxyShell, Ivanti exploits, credential replay, HERV phishing, and persistent mailbox monitoring to harvest GALs, credentials, and sensitive communications. The leak exposes end-to-end workflows: reconnaissance, exploitation, credential theft, HUMINT-focused collection, and centralized KPI reporting, confirming a mature, state-managed espionage apparatus.

The new Charming Kitten campaign demonstrates a significant escalation in the group’s operational maturity, combining strategic impersonation, long-term reconnaissance, and a large, automated infrastructure. The attackers impersonated Pentagon official Ariane Tabatabai to target Iranian activists, initiating contact via Telegram before redirecting victims through Google Sites to credential-harvesting domains using a WebSocket-based phishing kit. Evidence shows the group monitored security researcher activity for months, preparing infrastructure from May and launching operations in late July. More than 30 previously unseen domains support the campaign, reflecting increased automation, operational scale, and real-time monitoring. The operation highlights Charming Kitten’s growing geopolitical awareness and refined social engineering capability.

APT35 (Charming Kitten, Phosphorus, Mint Sandstorm) is an Iranian state-sponsored cyber espionage group linked to the Islamic Revolutionary Guard Corps (IRGC). Active since at least 2014, the group has targeted U.S. government officials, political campaigns, journalists, and prominent Iranian dissidents abroad. Their tactics include spear-phishing, credential theft, malware deployment, and persistence techniques. APT35 has been involved in high-profile incidents, including the HBO breach (2017), attacks on a U.S. presidential campaign (2019), and the development of HYPERSCRAPE (2022) for email theft. Their campaigns leverage social engineering, spoofed domains, and cloud-based persistence, with operations focusing on espionage and data exfiltration.

APT42 has been actively targeting NGOs, media, academia, legal services, and activists in Western and Middle Eastern countries. Using sophisticated social engineering tactics, APT42 poses as journalists and event organizers to deliver malware through spear phishing, harvesting credentials to access cloud environments. They deploy custom backdoors like NICECURL and TAMECAT for initial access and data exfiltration, utilizing built-in tools and open-source resources to remain undetected. The group employs masquerading techniques and typo-squatted domains to facilitate their campaigns.

Charming Kitten, an Iran nexus threat actor group, used the Sponsor backdoor to target 34 entities across Brazil, Israel, and UAE. Initial access was gained by exploiting Microsoft Exchange vulnerabilities (CVE-2021-26855). The campaign targeted various sectors, including automotive, communications, engineering, financial services, healthcare, insurance, legal, manufacturing, retail, technology, and telecommunications. Sponsor backdoor, disguised as an updater program, used discreetly deployed batch files to evade detection. Charming Kitten also deployed tools like Plink, Merlin agent, Mimikatz, and Meterpreter reverse shells.

On May 5–8, 2023, Microsoft Threat Intelligence reported that two Iranian state-backed groups had joined an ongoing wave of attacks targeting CVE-2023-27350, a pre-authentication critical remote code execution vulnerability (CVSS 9.8) in PaperCut MF and NG print management software versions 8.0 and later. The two groups are Mango Sandstorm (also known as Mercury or MuddyWater, linked to Iran's Ministry of Intelligence and Security/MOIS) and Mint Sandstorm (also known as Phosphorus or APT35, linked to Iran's Islamic Revolutionary Guard Corps/IRGC). Mint Sandstorm's exploitation was characterized as opportunistic, targeting organizations across multiple sectors and geographies without specific victim selection. Mango Sandstorm's activity was lower-volume, with operators reusing tools from prior intrusions to connect to existing C2 infrastructure — indicating the group was extending rather than initiating campaigns. The vulnerability had been disclosed in March 2023; public PoC exploits were released shortly after, enabling rapid threat actor adoption. Earlier exploitation was attributed to Lace Tempest (linked to Clop ransomware) and separately led to LockBit ransomware deployments. CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities catalog on April 21, 2023, mandating federal agencies patch by May 12. VulnCheck subsequently documented a new exploitation method that bypassed existing detections, highlighting the difficulty of detection-only defenses. PaperCut is used by over 100 million users at 70,000+ organizations including large enterprises, government bodies, and educational institutions globally. Patched versions are 20.1.7, 21.2.11, and 22.0.9 and later.

This Certfa Lab report details the cyber espionage activities of Charming Kitten (APT42), an Iranian state-sponsored hacking group. The report focuses on four specific operations ("Alfa," "Bravo," "Charlie," and "Delta"), illustrating how Charming Kitten uses sophisticated social engineering, primarily impersonating prominent individuals on LinkedIn and Twitter, to build trust with targets before delivering malicious links disguised as innocuous meeting requests or research materials. The attacks consistently leverage phishing to steal credentials, targeting researchers, academics, activists, and journalists with a particular focus on the Middle East and North Africa. The report aims to raise public awareness of Charming Kitten's tactics and provide recommendations for enhancing online security, particularly emphasizing the use of multi-factor authentication.

This report from Check Point Research details an Iranian spear-phishing campaign targeting high-profile former Israeli and US officials. According to Check Point, the high-profile targets of this operation include Tzipi Livni, former Israeli Foreign Minister and Deputy Prime Minister; a former major general in the Israeli Defence Forces (IDF) who held a highly sensitive position; the chairman of a leading Israeli security think tank; a former US ambassador to Israel; the former chairman of a prominent Middle East research centre; and a senior executive in the Israeli defence industry. The attackers used sophisticated techniques, including email thread hijacking and a custom URL shortener, to trick victims into revealing sensitive information. A legitimate identity verification service was also exploited to steal identity documents. The report analyses the attack infrastructure, methods and possible attribution to the Iran-linked Phosphorus APT group, suggesting a motive that may be linked to escalating geopolitical tensions between Iran and Israel. The ultimate goal appears to be access to victims' inboxes and personally identifiable information (PII), although the possibility of physical harm is also considered.

Deep Instinct researchers detected suspicious activity in a Southern U.S. infrastructure and construction company, revealing an attempted compromise of an Exchange server by an Iranian APT, PHOSPHORUS. Seven exploitation attempts were made, including installation of a root certificate and blending malicious traffic with legitimate. The attacker used malware to create a new user account, setup RDP access, and establish a reverse proxy to connect to the compromised system. A new evasion technique, involving masking malicious domains within legitimate ones, was also detected. PHOSPHORUS activities can be traced back to June 2020.

Iranian APT group Phosphorus has developed a new PowerShell backdoor, dubbed PowerLess Backdoor, for espionage purposes. Cybereason researchers discovered the backdoor while investigating the group's exploitation of the ProxyShell vulnerability. The backdoor allows for downloading additional payloads, evasive PowerShell execution, and encrypted communication with the command and control server. Connections were also found between the Phosphorus group and the Memento Ransomware.

Sophos discovered a novel ransomware approach by "Memento Team," which bypasses encryption detection by copying files into password-protected archives. Initially attempting direct encryption thwarted by endpoint protection, the actors retooled their method. They demanded $1 million for file restoration, threatening data exposure. The attack exploited a VMware vCenter Server vulnerability, with the attackers gaining initial access through a misconfigured firewall. Their activities included lateral movement using stolen credentials and deployment of a Python-based keylogger. The attack leveraged various tools like WinRAR, Mimikatz, and PowerShell, culminating in file archiving for ransom. The targeted sectors or countries were not specified in the report.

The DFIR Report's November 2021 case study documents a PHOSPHORUS (APT35/Charming Kitten) intrusion in late September 2021 in which the attacker exploited the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) on an internet-facing Microsoft Exchange server. Over 42 hours, three web shells were deployed in OWA directories. The attacker used PowerShell and cmd.exe via web shells to run Exchange discovery cmdlets (Get-Mailbox, Get-ExchangeServer), then enabled the built-in DefaultAccount, set its password to P@ssw0rd, and added it to Administrators and Remote Desktop Users groups. Plink was used to establish an SSH tunnel to 148.251.71[.]182 (tcp.symantecserver.co), exposing RDP externally. LSASS was dumped via Task Manager. Fast Reverse Proxy (FRP, renamed to dllhost.exe) was deployed for persistent RDP proxying via a scheduled task named CacheTask. Using stolen domain admin credentials, the actors performed internal port scanning with KPortScan 3.0, moved laterally to backup systems and domain controllers via RDP, and deployed Impacket's wmiexec on one domain controller. The final impact was domain-wide encryption: BitLocker on servers (via setup.bat) and DiskCryptor on workstations via dcrypt.exe, with a ransom note requesting 8,000 USD left on an unencrypted domain controller. No data exfiltration or Cobalt Strike was used — notably rare for a ransomware intrusion of this scale.

In December 2021, PHOSPHORUS exploited the Microsoft Exchange ProxyShell vulnerabilities, using web shells to gain initial access and execute code. The attack closely resembled their previous attacks and due to previous reports and OSINT research, DFIR believes with medium to high confidence that this intrusion would have ended in ransomware. The attackers established persistence through scheduled tasks and a newly created account, and after enumerating the environment, disabled LSA protection and dumped LSASS process memory. The entire attack was likely scripted out, as evidenced by the user agent strings and the similarity between commands.

The Iranian threat actor Phosphorus targeted potential attendees of the Munich Security Conference and the Think 20 (T20) Summit in Saudi Arabia through a series of cyberattacks. The attackers sent spoofed email invitations to former government officials, policy experts, academics, and leaders from non-governmental organizations. Their goal was intelligence collection, and they successfully compromised several high-profile individuals' accounts.

IBM X-Force IRIS uncovered extensive details on ITG18 through operational errors. Over 40 GB of data and videos revealed ITG18’s targeting of U.S. Navy and Hellenic Navy personnel, U.S. presidential campaigns, pharmaceutical companies, and Iranian-American figures. The group employed credential harvesting, phishing, and email compromise, often using Zimbra to manage compromised accounts. ITG18's operations align with Iranian strategic interests, leveraging personal accounts to gather sensitive data on military operations and geopolitical targets. Multifactor authentication posed challenges, causing operators to pivot to new targets.

ClearSky's October 2019 report documented an active Charming Kitten (APT35/Phosphorus) campaign targeting US presidential campaign staff, government officials, journalists, Iranian dissidents, and civil society figures including the Baha'i community. The campaign used four distinct impersonation vectors: fake Google Drive sharing links, SMS phishing messages, spoofed account login-attempt alerts, and fake social network profiles impersonating known contacts. Malicious links led to credential-harvesting pages mimicking Google, Yahoo, Facebook, and Instagram logins, hosted on a network of actor-registered domains. The group abused Google Sites and URL shorteners to obfuscate malicious destinations. Microsoft identified 99 domains tied to the operation (tracked internally as Phosphorus/Strontium) and obtained a court order to seize them. IOC overlaps with prior Certfa reporting confirm continuity of infrastructure across Charming Kitten campaigns dating to 2018. The campaign is assessed as part of Iran's broader effort to conduct cyber-enabled political intelligence collection ahead of the 2020 US presidential election.