Elusive Iranian APT Phishes Influential US Policy Wonks

Elusive Iranian APT UNK_SmudgedSerpent carried out highly targeted phishing against prominent US think tanks this summer, with activity noted between June and August 2025. The group impersonated policy influencers and used a mix of lures, including a slightly misspelled Gmail address and a Microsoft 365 credential phishing page delivered via a malicious URL masquerading as an OnlyOffice or Microsoft Teams link.

According to Proofpoint, UNK_SmudgedSerpent’s TTPs overlap with Iran’s major APTs, and the attackers appeared to borrow the approach of TA453 (Charming Kitten) while using infrastructure aligned with TA455 (Smoke Sandstorm); they were also the only Iranian threat actor known to deploy remote monitoring and management software besides MuddyWater.

The researchers noted that the overall attack character—target selection, phishing tone, and credential theft goal—resembled Charming Kitten, yet the supporting infrastructure bore closer resemblance to TA455, making attribution challenging. The piece discusses why attribution matters for security planning and the business case for threat intelligence, while acknowledging the difficulty in quantifying its impact.