IranAssessedIRGCMixedActive 2014 – 2026Charming Kitten
Also known asMint Sandstorm · PHOSPHORUS · Magic Hound · TA453 · NEWSCASTER · COBALT MIRAGE · Ballistic Bobcat · Cobalt Illusion · TEMP.Beanie · Timberworm · Yellow Garuda · CharmingCypress · Nemesis Kitten · DEV-0270 · Storm-0270 · Parastoo
Summary
IRGC-linked Iranian APT tracked by MITRE as Magic Hound (G0059; also APT35, Mint Sandstorm, TA453, Charming Kitten). Vendors overlap it with APT42, which MITRE now tracks separately (G1044), and names such as Educated Manticore and TA453 cover activity of both. MITRE: it has targeted European, US and Middle Eastern government and military personnel, academics and journalists through complex social engineering campaigns since at least 2014; Microsoft adds political dissidents and activist leaders. Trellix (March 2026) reports a React-based phishing kit intercepting MFA tokens across 130+ attacker-controlled domains, used against Israeli academics, technologists and journalists from January to June 2025. Proofpoint documents the pattern: a benign opening email and multi-persona impersonation to build rapport, fake podcast-interview or roundtable invitations, then a malicious link to cloud-hosted payloads (Dropbox, Google Scripts) or to a credential-phishing page.
Attribution
Islamic Revolutionary Guard Corps
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Iranian-sponsored, likely on behalf of the IRGC
Campaigns 6
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| TA453 think-tank credential phishing during the Iran war (Henry Jackson Society spoof) | 2026-02 – 2026-03 | USA | Think Tanks | Proofpoint (2026-03-11) |
| MFA-Token-Intercepting React Phishing Kit | 2025-01 – 2025-06 | Israel | Academia, Technology, Media | Trellix (2026-03-05) |
| Fake ISW podcast invitation — BlackSmith / AnvilEcho | 2024-07 | Undisclosed | Religious Organisations, Civil Society | Proofpoint (2024-08-20) |
| Nuclear Negotiator Targeting | 2023-05 | USA | Think Tanks | Proofpoint (2023-07-06) |
| DEV-0270 / Nemesis Kitten (PHOSPHORUS sub-group) — BitLocker/DiskCryptor ransomware operations | 2022 | Global | Multiple | Microsoft Threat Intelligence (2022-09-07) |
| Mint Sandstorm subgroup — US critical-infrastructure targeting and rapid N-day exploitation | 2021 – 2023-02 | USA, Israel, Europe | Energy, Transportation, Maritime/Ports, Think Tanks, Academia | Microsoft Threat Intelligence (2023-04-18) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Resource Development1 | T1585.002Email Accounts |
|---|---|
| Initial Access2 | T1566.002Spearphishing LinkT1190Exploit Public-Facing Application |
| Execution1 | T1059.001PowerShell |
| Credential Access3 | T1056.001KeyloggingT1111Multi-Factor Authentication InterceptionT1003.001LSASS Memory |
Malware and tools 8
| Name | Description | Platform |
|---|---|---|
| POWERSTAR/CharmPower | PowerShell Backdoor | Windows |
| HYPERSCRAPE | Email Data Stealer | Windows |
| NokNok | macOS Backdoor | macOS |
| BellaCiao | Personalized dropper (a separate build per victim) | Windows |
| BASICSTAR | Backdoor | Windows |
| BellaCPP | C++ port of the BellaCiao implant | Windows |
| BlackSmith | Malware toolset (loader chain delivering AnvilEcho) | Windows |
| AnvilEcho | PowerShell trojan (single-script successor to TA453 modular backdoors) | Windows |
Exploited vulnerabilities 7
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4Shell (KEV 2021-12-10) |
| CVE-2022-47966 | 9.8 | Zoho ManageEngine (KEV 2023-01-23) |
| CVE-2022-47986 | 9.8 | IBM Aspera Faspex — YAML deserialization RCE (KEV 2023-02-21) |
| CVE-2018-13379 | 9.1 | Fortinet FortiOS SSL VPN — path traversal (KEV 2021-11-03) |
| CVE-2021-34473 | 9.1 | Microsoft Exchange Server "ProxyShell" — RCE (KEV 2021-11-03) |
| CVE-2021-34523 | 9 | Microsoft Exchange Server "ProxyShell" — privilege escalation (KEV 2021-11-03) |
| CVE-2021-31207 | 6.6 | Microsoft Exchange Server "ProxyShell" — security feature bypass (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Actor-run GitHub repos host C2 domain rotators for Drokbk and Soldier (Microsoft, 2023)
- webhook.site for C2 and OneDrive for remote payloads (Microsoft, 2023)
- Dedicated C2 domains for BlackSmith and AnvilEcho — d75[.]site, deepspaceocean[.]info — as TA453 (Proofpoint, 2024)
Reporting and advisories 11
- CISA
AA22-257A — IRGC-Affiliated Cyber Actors - Proofpoint
Nuclear Negotiator Targeting - Trellix
MFA-Token-Intercepting React Phishing Kit - Proofpoint
TA453 think-tank credential phishing during the Iran war (Henry Jackson Society spoof) - Proofpoint
Fake ISW podcast invitation — BlackSmith / AnvilEcho - Microsoft Threat Intelligence
Mint Sandstorm subgroup — US critical-infrastructure targeting and rapid N-day exploitation - Microsoft Threat Intelligence
DEV-0270 / Nemesis Kitten (PHOSPHORUS sub-group) — BitLocker/DiskCryptor ransomware operations - MITRE ATT&CK
Charming Kitten (G0059) group profile - Google TAG
New Iranian APT data extraction tool — HYPERSCRAPE (Aug 2022) - Volexity
CharmingCypress: Innovating Persistence — BASICSTAR (Feb 2024) - Bitdefender
Unpacking BellaCiao: A Closer Look at Iran's Latest Malware (Apr 2023)