Threat actor
Charming Kitten
Iran · espionage
Tracked by CyberSIXT since 8 Oct 2025
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
4 articles from 1 outlet since 8 Oct 2025; the latest 125 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 22 Jun · 23:40 UTC | dti.domaintools.com | Leaked files show APT35 runs like a government department |
| Fri 28 Nov 2025 · 10:50 UTC | SecurityWeek | In Other News: HashJack AI Browser Attack, Charming Kitten Leak, Hacker Unmasked |
| Fri 21 Nov 2025 · 20:21 UTC | dti.domaintools.com | Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets |
| Wed 8 Oct 2025 · 09:55 UTC | GBHackers | APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked Group |
Names and sources
- Charming Kitten
- Named by CyberSIXT coverage
- APT35
- Named by Malpedia · charming_kitten
- Charming Kitten
- Named by Malpedia · charming_kitten
- CharmingCypress
- Named by Malpedia · charming_kitten
- G0058
- Named by Malpedia · charming_kitten
- Group 83
- Named by Malpedia · charming_kitten
- Mint Sandstorm
- Named by Malpedia · charming_kitten
- NewsBeef
- Named by Malpedia · charming_kitten
All 21 names
- Newscaster
- Named by Malpedia · charming_kitten
- PHOSPHORUS
- Named by Malpedia · charming_kitten
- Parastoo
- Named by Malpedia · charming_kitten
- iKittens
- Named by Malpedia · charming_kitten
- Charming Kitten
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- CharmingCypress
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- G0058
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- Group 83
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- Mint Sandstorm
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- NewsBeef
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- Newscaster
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- Parastoo
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
- iKittens
- Named by MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232
Attributed facts
- motivation
- espionage (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- origin
- Iran (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sector
- Defense (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sector
- Diplomacy (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sector
- Government (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sector
- Government, Administration (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sector
- Military (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sector
- Technology (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- sponsor
- Iran (Islamic Republic of) (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- Target country
- Iraq (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- Target country
- Israel (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- Target country
- Saudi Arabia (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- Target country
- U.S. government/defense sector websites (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
- Target country
- United Kingdom (MISP Galaxy · f98bac6b-12fd-4cad-be84-c84666932232)
Malware and tools
LittleLooter (Malpedia · charming_kitten) CHAIRSMACK (Malpedia · charming_kitten) DownPaper (Malpedia · charming_kitten) MediaPI (Malpedia · charming_kitten) StoneDrill (Malpedia · charming_kitten) TelegramGrabber (Malpedia · charming_kitten) Unidentified 073 (Charming Kitten) (Malpedia · charming_kitten)
- Leaked files show APT35 runs like a government departmentdti.domaintools.com
- In Other News: HashJack AI Browser Attack, Charming Kitten Leak, Hacker UnmaskedSecurityWeek
- Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targetsdti.domaintools.com
- APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked GroupGBHackers · first in our coverage