{"id":49725,"date":"2022-12-15T02:35:09","date_gmt":"2022-12-15T02:35:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/iran-linked-charming-kitten-espionage-gang-bares-claws-to-pollies-power-orgs\/"},"modified":"2022-12-15T02:35:09","modified_gmt":"2022-12-15T02:35:09","slug":"iran-linked-charming-kitten-espionage-gang-bares-claws-to-pollies-power-orgs","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/iran-linked-charming-kitten-espionage-gang-bares-claws-to-pollies-power-orgs\/","title":{"rendered":"Iran-linked Charming Kitten espionage gang bares claws to pollies, power orgs"},"content":{"rendered":"

An Iranian cyber espionage gang with ties to the Islamic Revolutionary Guard Corps has learned new methods and phishing techniques, and aimed them at a wider set of targets \u2013 including politicians, government officials, critical infrastructure and medical researchers \u2013 according to email security vendor Proofpoint.<\/p>\n

Over the past two years, the threat actor group that Proofpoint’s researchers track as TA453 (other intel teams call this state-backed gang Charming Kitten<\/a>, Phosphorus<\/a>, and APT42) has branched out from its usual victims \u2013 academics, researchers, diplomats, dissidents, journalists and human rights workers \u2013 and adopted new means of attack.<\/p>\n

While the group’s past email campaigns often deployed web beacons tucked inside messages that ultimately led to stolen credentials, Proofpoint has observed “outlier” campaigns over the past couple of years that used “new-to-TA453 phishing techniques including compromised accounts, malware, and confrontational lures.”<\/p>\n