Mysterious 'SmudgedSerpent' Hackers Target U.S. Policy Experts Amid Iran–Israel Tensions

A new threat activity cluster, codenamed UNK_SmudgedSerpent, has been attributed to attacks on academics and foreign policy experts from June to August 2025, timed with heightened Iran–Israel tensions. According to Proofpoint, the group leveraged domestic political lures around societal change in Iran and investigations into the IRGC’s militarisation, in campaigns that resemble earlier Iranian espionage patterns such as those linked to TA455, TA453 and TA450.

The emails employ classic Charming Kitten techniques, including benign conversations to entice targets before phishing for credentials, with some messages delivering malicious MSI installers via links masquerading as Microsoft Teams and hosting PDQ Connect; decoy documents and OnlyOffice-themed pages are also used. Targets include more than 20 U.S.-based think-tank subject matter experts on Iran-related policy, with impersonations of Brookings Institution and Washington Institute figures to add credibility.

The operation appears to involve hands-on-keyboard activity to deploy additional RMM tools and may reflect evolving cooperation between Iranian intelligence entities and cyber units.