Charming Kitten

MITRE ATT&CK: G0058 View on attack.mitre.org

Aliases: Newscaster, Parastoo, iKittens, Group 83, NewsBeef, CharmingCypress, Mint Sandstorm, Charming Kitten

Origin
IR
Actor type
Espionage
Last IoC activity
2026-07-03 01:02:41
Profile updated
2026-07-07 11:28:33

Context

Charming Kitten is an Iranian cyber espionage group that has been active since approximately 2014. They appear to focus on targeting individuals of interest to Iran who work in academic research, human rights, and media, with most victims having been located in Iran, the US, Israel, and the UK. [Charming Kitten often tries to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. The group's TTPs overlap extensively with another group, Magic Hound, resulting in reporting that may not distinguish between the two groups' activities.

Related threat objects

Reports & references

  • CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
  • Wikipedia — Operation Newscaster (report)
  • iranthreats.github.io — Macdownloader Macos Malware (report)
  • paper.seebug.org — File 2581720763 Pdf (report)
  • forbes.com — Iran Hackers Oilrig Use Fake Personas On Facebook Linkedin For Cyberespionage (report)
  • cryptome.org — Parastoo Hacks Iaea (report)
  • Kaspersky — Report Shamoon Stonedrill Final (report)
  • Kaspersky — Freezer Paper Around Free Meat (report)
  • verfassungsschutz.de — Broschuere 2016 10 Bfv Cyber Brief 2016 04 (report)
  • cfr.org — Newscaster (report)
  • washingtontimes.com — Iranian Hackers Sucker Punch Us Defense Heads Crea (report)
  • Kaspersky — 74503 (report)
  • scmagazine.com — Hbo Breach Accomplished With Hard Work By Hacker Poor Security Practices By Victim (report)
  • arabnews.com — Media (report)
  • cyware.com — Iranian Apt Charming Kitten Impersonates Clearsky The Security Firm That Uncovered Its Campaigns 7Fea0B4F (report)
  • blog.certfa.com — The Return Of The Charming Kitten (report)
  • justice.gov — Former Us Counterintelligence Agent Charged Espionage Behalf Iran Four Iranians Charged Cyber (report)
  • Microsoft — New Steps To Protect Customers From Hacking (report)
  • clearskysec.com — Charming Kitten 2017 (report)
  • MITRE ATT&CK — G0058 (report)
  • volexity.com — Charmingcypress Innovating Persistence (report)
  • clearskysec.com — Charming Kitten 2017 (report)

Attributed from

  • TA455 Iranian Dream Job Campaign (campaign)

External references