Threats Feed

Leaked internal documents reveal a highly structured APT35 (Charming Kitten) operation run as a quota-driven, bureaucratic intelligence unit within the IRGC IO. The materials detail coordinated, long-term cyber-espionage campaigns targeting Lebanon, Kuwait, Turkey, Saudi Arabia, South Korea, and domestic Iranian entities, with a strong focus on diplomatic, governmental, telecom, energy, and large commercial mail systems. Operators used ProxyShell, Ivanti exploits, credential replay, HERV phishing, and persistent mailbox monitoring to harvest GALs, credentials, and sensitive communications. The leak exposes end-to-end workflows: reconnaissance, exploitation, credential theft, HUMINT-focused collection, and centralized KPI reporting, confirming a mature, state-managed espionage apparatus.

The new Charming Kitten campaign demonstrates a significant escalation in the group’s operational maturity, combining strategic impersonation, long-term reconnaissance, and a large, automated infrastructure. The attackers impersonated Pentagon official Ariane Tabatabai to target Iranian activists, initiating contact via Telegram before redirecting victims through Google Sites to credential-harvesting domains using a WebSocket-based phishing kit. Evidence shows the group monitored security researcher activity for months, preparing infrastructure from May and launching operations in late July. More than 30 previously unseen domains support the campaign, reflecting increased automation, operational scale, and real-time monitoring. The operation highlights Charming Kitten’s growing geopolitical awareness and refined social engineering capability.

Educated Manticore, an Iranian APT group linked to the IRGC Intelligence Organization, launched spear-phishing campaigns targeting Israeli cybersecurity experts, computer science academics, and journalists. Using personas of fake cybersecurity employees or researchers, attackers engaged victims via email and WhatsApp, luring them to phishing pages disguised as Google or Google Meet login portals. A custom React-based phishing kit captured credentials and two-factor authentication tokens in real time via WebSocket, supported by infrastructure spanning over 130 attacker-controlled domains. The campaign emphasizes credential harvesting and identity theft in support of Iranian cyber-espionage objectives amid heightened Iran–Israel tensions.

APT35 (Charming Kitten, Phosphorus, Mint Sandstorm) is an Iranian state-sponsored cyber espionage group linked to the Islamic Revolutionary Guard Corps (IRGC). Active since at least 2014, the group has targeted U.S. government officials, political campaigns, journalists, and prominent Iranian dissidents abroad. Their tactics include spear-phishing, credential theft, malware deployment, and persistence techniques. APT35 has been involved in high-profile incidents, including the HBO breach (2017), attacks on a U.S. presidential campaign (2019), and the development of HYPERSCRAPE (2022) for email theft. Their campaigns leverage social engineering, spoofed domains, and cloud-based persistence, with operations focusing on espionage and data exfiltration.

Kaspersky has uncovered BellaCPP, a new C++ variant of the BellaCiao malware family, linked to the Charming Kitten threat actor. BellaCPP, found on an infected machine in Asia, features domain generation, XOR-encrypted string decryption, and SSH tunneling, with payloads stored in critical directories like C:\Windows\System32. It lacks a webshell, showing refined design. PDB paths reveal targeting details, highlighting evolving capabilities. These findings underscore the need for robust cybersecurity and thorough network scanning to combat such threats.

APT35 targeted the aerospace and semiconductor industries in the US, Thailand, UAE, and Israel using fake recruitment and corporate websites. These sites delivered malware via forged legitimate programs and malicious DLLs to compromise victims. The group leveraged platforms like GitHub, OneDrive, and Google Cloud for C&C communications and payload delivery. In a related attack, a semiconductor company was targeted using a VPN program laced with malicious components. Persistence mechanisms included registry modifications, while obfuscation techniques were used to evade detection. APT35’s activities are linked to the Islamic Revolutionary Guard Corps (IRGC) of Iran.

Charming Kitten has launched a new cyber campaign targeting NGOs and media organizations in Western and Middle Eastern countries. The campaign begins with initial contact via a Yahoo email, followed by a phishing link sent through WhatsApp. To build credibility, attackers may initiate silent WhatsApp voice calls before redirecting victims to a phishing site designed to mimic Google Meet. This page, hosted on Google Sites, employs an EventListener script to capture any entered data and send it to the attackers' server. Indicators of compromise include the domain atlanticcouncil[.]site and specific WhatsApp numbers.

Since June 2024, the Iranian-linked threat group Charming Kitten (APT42) has continued to build phishing infrastructure, identified as Cluster B, to target individuals perceived as threats to the Iranian regime, including researchers, journalists, NGO leaders, and human rights activists. The group registered several new domains, likely intended to host credential phishing pages that masquerade as Google, YouTube, and file-hosting service login portals. Past campaigns have targeted individuals in the U.S., Israel, and Europe, primarily in the research, media, and academic sectors. The phishing emails often contain malicious links disguised as conference invitations or legitimate documents.

The Mint Sandstorm campaign exhibited sophisticated cyberattack tactics targeting universities and research organizations. Notably, the campaign utilized compromised email accounts for phishing, leveraging social engineering by impersonating high-profile individuals, such as journalists. Initial emails were benign, building trust before delivering malicious content. The attacks involved using the curl command for connecting to a C2 server, downloading malicious files, and deploying custom backdoors like MediaPl and MischiefTut. MediaPl disguised as Windows Media Player, encrypted communications, and used unique persistence methods. The attackers aimed to exfiltrate data and maintain long-term access to compromised systems, posing significant risks to the confidentiality and reputation of the targeted organizations.

Charming Kitten, an Iran nexus threat actor group, used the Sponsor backdoor to target 34 entities across Brazil, Israel, and UAE. Initial access was gained by exploiting Microsoft Exchange vulnerabilities (CVE-2021-26855). The campaign targeted various sectors, including automotive, communications, engineering, financial services, healthcare, insurance, legal, manufacturing, retail, technology, and telecommunications. Sponsor backdoor, disguised as an updater program, used discreetly deployed batch files to evade detection. Charming Kitten also deployed tools like Plink, Merlin agent, Mimikatz, and Meterpreter reverse shells.

The Ballistic Bobcat (aka Charming Kitten) threat group exploited known vulnerabilities in Microsoft Exchange servers, particularly CVE-2021-26855, to gain initial access to 34 organizations, primarily located in Israel. The group employed a backdoor known as Sponsor and relied on a modular approach that used both configuration files and batch files to evade detection. Besides, the group utilized a range of open-source tools for various activities, including tunneling and credential dumping. The victims are from diverse sectors but are mainly opportunistic rather than specifically targeted. Two victims were identified outside Israel, in Brazil and the UAE, linked to healthcare and an unidentified organization.

AttackIQ's August 2023 report profiles APT35 (also known as Charming Kitten and Phosphorus), an Iranian state-sponsored espionage group active since at least 2014. The report presents an attack graph emulating APT35's December 2021 exploitation of Microsoft Exchange ProxyShell vulnerabilities — CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 — to gain initial access across targets in Europe, the Middle East, and North America. The documented attack chain begins with web shell deployment on the compromised Exchange server, followed by scheduled task persistence, disabling of Microsoft Defender via registry modification, WDigest authentication enablement for plaintext credential capture, LSASS memory dumping via rundll32.exe and comsvcs.dll, and data exfiltration via HTTP POST requests. The group also created local accounts added to the Administrators and Remote Desktop Users groups and opened port 3389 (RDP) through Windows Firewall for persistent remote access. APT35 targets government entities, academic institutions, media organizations, defense, energy, engineering, business services, and telecommunications sectors, with a particular focus on the United States and Middle East.

Charming Kitten has intensified its cyber espionage operations targeting Iranian dissidents, legal professionals, journalists, and human rights activists in Germany and abroad. According to the German BfV, the group uses detailed social engineering and spoofed online identities to initiate contact and build trust. Victims are lured into video calls via phishing links that mimic legitimate platforms like Google or Microsoft. These links lead to credential-harvesting sites, often intercepting two-factor authentication as well. Stolen credentials are then used to access cloud services and extract personal data using tools like Google Takeout.

The Iranian cyber-espionage group, Charming Kitten, targeted an individual who published an article about Iran. The attackers impersonated a reporter and carried out a series of seemingly benign interactions before sending a malicious RAR file containing the POWERSTAR backdoor. The backdoor, once executed, collects system information and communicates with a command-and-control server via encrypted channels. The attackers employ several modules for system reconnaissance, establishing persistence, and cleaning up forensic evidence. Notably, they leveraged the InterPlanetary File System (IPFS) as a fallback mechanism for command-and-control communication.

On May 5–8, 2023, Microsoft Threat Intelligence reported that two Iranian state-backed groups had joined an ongoing wave of attacks targeting CVE-2023-27350, a pre-authentication critical remote code execution vulnerability (CVSS 9.8) in PaperCut MF and NG print management software versions 8.0 and later. The two groups are Mango Sandstorm (also known as Mercury or MuddyWater, linked to Iran's Ministry of Intelligence and Security/MOIS) and Mint Sandstorm (also known as Phosphorus or APT35, linked to Iran's Islamic Revolutionary Guard Corps/IRGC). Mint Sandstorm's exploitation was characterized as opportunistic, targeting organizations across multiple sectors and geographies without specific victim selection. Mango Sandstorm's activity was lower-volume, with operators reusing tools from prior intrusions to connect to existing C2 infrastructure — indicating the group was extending rather than initiating campaigns. The vulnerability had been disclosed in March 2023; public PoC exploits were released shortly after, enabling rapid threat actor adoption. Earlier exploitation was attributed to Lace Tempest (linked to Clop ransomware) and separately led to LockBit ransomware deployments. CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities catalog on April 21, 2023, mandating federal agencies patch by May 12. VulnCheck subsequently documented a new exploitation method that bypassed existing detections, highlighting the difficulty of detection-only defenses. PaperCut is used by over 100 million users at 70,000+ organizations including large enterprises, government bodies, and educational institutions globally. Patched versions are 20.1.7, 21.2.11, and 22.0.9 and later.

Charming Kitten group's latest malware, BellaCiao, targets Microsoft Exchange servers across the United States, Europe, the Middle East (Turkey), and India. The malware uses a unique communication approach with its command-and-control infrastructure and is tailored to suit individual targets. BellaCiao is a dropper malware that delivers other payloads based on instructions from the C2 server. The initial infection vector is suspected to be Microsoft Exchange exploit chains, and the malware establishes persistence by masquerading as legitimate Microsoft Exchange server processes.

Educated Manticore, an Iranian-aligned threat actor linked to the Phosphorus group, has been found targeting Israel with an improved arsenal of tools. The group adopts recent trends, using ISO images and other archive files to initiate infection chains. They have significantly enhanced their toolset with techniques such as .NET executables constructed as Mixed Mode Assembly. The final payload is an updated version of the implant PowerLess, previously attributed to Phosphorus ransomware operations. This evolution shows the group's continuous refinement of their toolsets and delivery mechanisms.

The report details the Mint Sandstorm subgroup's cyberattacks targeting US critical infrastructure, including seaports, energy companies, transit systems, and a major utility and gas entity. The group rapidly adopted publicly disclosed proof-of-concept (POC) code to exploit vulnerabilities in internet-facing applications. The attacks also involved custom tools and implants, lateral movement, and persistence techniques. The phishing campaigns targeted individuals affiliated with think tanks and universities in Israel, North America, and Europe. The targeted sectors include transportation, energy, utilities, policy, security, and academia.

The Secureworks report details a phishing campaign by the Iranian threat group COBALT ILLUSION, which used a fake Atlantic Council employee, "Sara Shokouhi", to target researchers working on human rights in Iran. The campaign used stolen imagery and a fake online presence to build rapport before attempting to steal credentials or deploy malware. This tactic mirrors previous COBALT ILLUSION operations, highlighting the consistent use of sophisticated social engineering and data harvesting techniques to gather intelligence on behalf of the Iranian government. The report provides indicators of compromise (IOCs) to help mitigate further attacks.

The Iranian APT group, Charming Kitten (APT35), targets human rights activities, academia, media organizations, and political entities in the US and Central Eastern countries. Notable attacks include the 2017 HBO hack, which led to leaked unaired TV episodes, and interference attempts in the 2019 US elections, primarily targeting email accounts. Tools used by APT35 include DownPaper, which utilizes PowerShell and registry manipulation, Mimikatz for credential dumping, PsExec for remote execution, and PupyRAT for cross-platform control via phishing techniques.

This Certfa Lab report details the cyber espionage activities of Charming Kitten (APT42), an Iranian state-sponsored hacking group. The report focuses on four specific operations ("Alfa," "Bravo," "Charlie," and "Delta"), illustrating how Charming Kitten uses sophisticated social engineering, primarily impersonating prominent individuals on LinkedIn and Twitter, to build trust with targets before delivering malicious links disguised as innocuous meeting requests or research materials. The attacks consistently leverage phishing to steal credentials, targeting researchers, academics, activists, and journalists with a particular focus on the Middle East and North Africa. The report aims to raise public awareness of Charming Kitten's tactics and provide recommendations for enhancing online security, particularly emphasizing the use of multi-factor authentication.

A new tool called HYPERSCRAPE, discovered by Google Threat Analysis Group in December 2021, has been found to be used by Charming Kitten to steal user data from Gmail, Yahoo and Microsoft Outlook accounts. HYPERSCRAPE requires the victim's account credentials to run, and once logged in, it changes the account's language settings to English, downloads messages individually as .eml files, and reverts the language back to its original settings once the inbox has been downloaded.

Yellow Garuda has been observed using a new Telegram 'grabber' tool alongside Android malware for domestic targeting, including victims likely linked to the Iranian music industry. The threat actor has been active since 2012, primarily using phishing attacks to harvest credentials. Despite operational security errors, Yellow Garuda has expanded its toolset to include macro-enabled template files. The observed document lures used themes related to nuclear energy, weapons, US shipping ports, and Iran's relationship with the Taliban, indicating potential targeting of a wide range of sectors.