Loading threat actor…
Charming Kitten is an Iranian state-sponsored cyberespionage threat actor active since at least 2014 and widely tracked under aliases including APT35, APT42, Phosphorus, TA453, ITG18, UNC788, Yellow Garuda, Ajax, Mint Sandstorm, and NewsBeef. The group is commonly linked to the Islamic Revolutionary Guard Corps and conducts persistent intelligence collection against individuals and organizations of strategic interest to the Iranian state. The actor is best known for highly tailored social-engineering and credential-phishing operations. Its campaigns frequently rely on impersonation of journalists, researchers, policy experts, and think-tank personnel; fictitious personas; compromised legitimate accounts; and prolonged trust-building conversations conducted over email, LinkedIn, messaging platforms, and voice or video calls before delivery of phishing links. Reported targets include academics, journalists, human-rights activists, dissidents, minority-rights advocates, think-tank staff, government personnel, diplomats, and military- or policy-adjacent experts. Targeting has included Iranian and foreign citizens, with notable focus on the United States, Israel, France, and the broader Middle East and Europe. Additional reported victim sectors include medical research and COVID-19-related organizations, as well as financial, telecommunications, and technology entities. Operationally, Charming Kitten has emphasized credential theft and surveillance, including theft of email, Google, and social-media accounts, and in some cases capture of two-factor authentication information. The group has also used hijacked victim accounts to approach secondary targets and collect sensitive relationship data. Beyond phishing, reporting has tied the actor to custom malware and post-compromise tooling, including the PowerLess backdoor, keylogging and browser-information-stealing modules, audio-recording tooling, credential dumping, persistence mechanisms, reconnaissance, and attempted lateral movement. Observed intrusion chains have included exploitation of public-facing enterprise software vulnerabilities followed by deployment of tunneling tools, loaders, and additional payloads. The actor has also shown defense-evasion tradecraft, including executing PowerShell functionality within a .NET context to reduce visibility. Charming Kitten is primarily an espionage actor rather than a ransomware operator. Although some reporting noted an unfinished locker and possible overlap with Memento ransomware infrastructure or developer artifacts, the group’s established mission remains intelligence collection, surveillance, and access acquisition in support of Iranian state interests.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-linked threat actor referenced in the context of having its infrastructure, tools, targets, and operational practices exposed by a third party (KittenBusters).
Charming Kitten is an Iranian state-sponsored cyber-espionage group involved in information operations, domain and server infrastructure management, and use of shell companies for operational cover.
Charming Kitten is engaged in phishing and credential harvesting campaigns targeting financial, telecom, and technology sectors, exploiting vulnerabilities in public-facing applications such as Confluence.
Charming Kitten is an IRGC-backed group known for espionage, targeting government, defense, academia, dissidents, and media, primarily in the US, Israel, Europe, and the Middle East. They use spear-phishing, credential harvesting, and exploit Microsoft Exchange vulnerabilities. Recent activities include targeting US election accounts and Israeli cybersecurity experts.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.