Iranian Hackers Exploit RMM Tools to Target Academics and Foreign-Policy Experts

According to Proofpoint Threat Research, a previously unknown Iranian threat actor dubbed UNK_SmudgedSerpent conducted sophisticated phishing campaigns against academics and foreign policy experts between June and August 2025. The group used credential harvesting techniques, social engineering, and remote management tools to infiltrate targets, revealing overlaps with three established Iranian threat groups and complicating attribution.

The campaign began in June 2025 when benign emails about economic uncertainty and political unrest in Iran were sent to over 20 members of a United States–based think tank, with the attackers impersonating Suzanne Maloney, the Brookings Institution’s vice president and director of the Foreign Policy program, using a Gmail address with a misspelled name.

Their infection chain involved URLs masquerading as OnlyOffice links that redirected to health-themed attacker domains, followed by credential harvesting pages and spoofed Microsoft login pages, ultimately loading RMM tools such as PDQConnect and ISL Online. The operation bore similarities to TA453 (Charming Kitten), TA455 (C5 Agent), and TA450 (MuddyWater), while the use of RMM tooling highlighted a tactic that remains rare among state-sponsored actors. Since August 2025, no further UNK_SmudgedSerpent activity has been detected, though researchers believe related operations likely continue.