New Iranian-Linked APT UNK_SmudgedSerpent Uses RMM Tools and M365 Spoofing for Espionage

Proofpoint Threat Research has identified a previously unknown Iranian-linked espionage group, UNK_SmudgedSerpent, conducting targeted phishing against academics and foreign policy experts since mid-2025. According to Proofpoint, the campaigns use social engineering that begins with legitimate academic or policy discussions before switching to credential harvesting and then spoofed login pages for OnlyOffice or Microsoft 365.

The attackers have impersonated figures such as Suzanne Maloney, deploying a fake Gmail account and reaching more than 20 U.S.-based think tank members; links redirect to a health-themed attacker domain, thebesthomehealth[.]com, and then to mosaichealthsolutions[.]com hosting a fake Microsoft 365 login page. Once credentials are harvested, UNK_SmudgedSerpent reportedly deploys Remote Monitoring and Management tools, including PDQConnect and ISL Online, to maintain persistence.

The campaign overlaps with known Iranian APT tooling, and attribution remains uncertain as analysts note cross-over with TA450 (MuddyWater) and TA455 (C5 Agent, Smoke Sandstorm) operations.