Loading threat actor…
UNK_SmudgedSerpent is a previously unidentified Iranian-linked espionage threat cluster active at least between June and August 2025. The actor targeted U.S.-based academics, think-tank personnel, and foreign policy experts, especially individuals focused on Iran, the Middle East, and related strategic issues. Its operations align with Iranian intelligence collection priorities centered on policy analysis, academia, and government-adjacent expertise. The cluster used patient, human-centered social engineering. Campaigns commonly began with benign or collaboration-themed email exchanges, often impersonating prominent foreign policy figures or institutions, before progressing to credential-harvesting attempts. The actor used spoofed Microsoft 365, Microsoft Teams, and OnlyOffice-themed login experiences, including customized phishing pages pre-populated with victim details to increase plausibility. In some cases, when credential theft appeared unsuccessful or targets became suspicious, the operation pivoted to malware delivery through installer packages that deployed legitimate remote monitoring and management software, followed by suspected hands-on-keyboard activity and installation of additional remote access tooling. Observed tradecraft overlaps with several major Iranian state-aligned groups, particularly TA453 / Charming Kitten / Mint Sandstorm, TA455 / Smoke Sandstorm / UNC1549, and TA450 / MuddyWater / Mango Sandstorm. The overlap includes victimology, conversational phishing, credential theft, OnlyOffice-themed infrastructure, and abuse of remote management tools. Attribution to any single known group remains low confidence, and the cluster is best treated as a distinct tracked actor pending clearer linkage. The mixed signals are consistent with possible shared infrastructure, contractor overlap, personnel movement, or collaboration across elements of Iran’s cyber ecosystem, including organizations associated with the IRGC and MOIS. UNK_SmudgedSerpent is assessed as an espionage-focused actor rather than a ransomware or financially motivated operation. Its known behavior emphasizes social engineering, credential harvesting, remote access enablement, and post-compromise operator interaction against high-value policy and research targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Human-centric espionage targeting US academics and policy experts through impersonation, credential harvesting, and follow-on persistent access using commercial remote management tools.
Conducting phishing and supply chain attacks targeting high-value individuals and enterprise networks, leveraging fake platforms and developer tools.
Suspected Iran-nexus espionage cluster targeting academics/foreign policy experts using social engineering rapport-building, benign conversation starters, themed infrastructure, file-hosting spoofs, and RMM tooling; attribution overlaps with multiple known Iranian groups.
Targeted Iranian-aligned espionage activity against U.S. policy experts using social engineering, credential phishing, and follow-on tooling (MSI delivery leading to RMM) consistent with hands-on-keyboard intrusion.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.