#charmingkitten — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #charmingkitten, aggregated by home.social.
-
How a hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East
#CharmingKitten #WhatsApp
https://techcrunch.com/2026/01/16/how-a-hacking-campaign-targeted-high-profile-gmail-and-whatsapp-users-across-the-middle-east/ -
How a hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East
#CharmingKitten #WhatsApp
https://techcrunch.com/2026/01/16/how-a-hacking-campaign-targeted-high-profile-gmail-and-whatsapp-users-across-the-middle-east/ -
0day Browser RCE von Charming Kitten / APT35 oder schlechte Berichterstattung?
Angeblich wurde auf einen Link geklickt und dadurch™ der Rechner infiziert.
-
0day Browser RCE von Charming Kitten / APT35 oder schlechte Berichterstattung?
Angeblich wurde auf einen Link geklickt und dadurch™ der Rechner infiziert.
-
BellaCPP, Charming Kitten’s BellaCiao variant written in C++ – Source: securityaffairs.com https://ciso2ciso.com/bellacpp-charming-kittens-bellaciao-variant-written-in-c-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #CharmingKitten #BreakingNews #Intelligence #SecurityNews #hackingnews #BellaCPP #hacking #Malware #Iran #APT
-
BellaCPP, Charming Kitten’s BellaCiao variant written in C++ – Source: securityaffairs.com https://ciso2ciso.com/bellacpp-charming-kittens-bellaciao-variant-written-in-c-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #CharmingKitten #BreakingNews #Intelligence #SecurityNews #hackingnews #BellaCPP #hacking #Malware #Iran #APT
-
Iranian Cyber Actors Targeting Personal Accounts to Support Operations
#CharmingKitten
https://www.ic3.gov/Media/News/2024/240927.pdf -
Cyclops: a likely replacement for BellaCiao
#CharmingKitten #BellaCiao #Cyclops
https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/ -
Our team just released a report on #CharmingKitten/#APT35: https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/
We discovered a new malware family called Cyclops, written in Go. It launches a local web server which exposes a REST API used to control the malware. The port is forwarded to the C2 via SSH.
We believe Cyclops was developed as a replacement for the (burnt) BellaCiao implant.
There seem to be very few samples in existence and we'd be curious to know if anyone else can find some. Suspected area of activity is the Middle-East since December 2023.Reverse-engineering was a challenge due to the malware expecting mashalled objects from the network. How do you figure out their expected structure with Golang when there's no constructor? If there's any interest, I may write a separate blog post or thread on the subject.
IOCs and more in the full post. Enjoy!
-
Our team just released a report on #CharmingKitten/#APT35: https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/
We discovered a new malware family called Cyclops, written in Go. It launches a local web server which exposes a REST API used to control the malware. The port is forwarded to the C2 via SSH.
We believe Cyclops was developed as a replacement for the (burnt) BellaCiao implant.
There seem to be very few samples in existence and we'd be curious to know if anyone else can find some. Suspected area of activity is the Middle-East since December 2023.Reverse-engineering was a challenge due to the malware expecting mashalled objects from the network. How do you figure out their expected structure with Golang when there's no constructor? If there's any interest, I may write a separate blog post or thread on the subject.
IOCs and more in the full post. Enjoy!
-
📬 Die stille Gefahr: Wie APT-Gruppen Unternehmen infiltrieren
#Datenschutz #ITSicherheit #AdvancedPersistentThreats #APTGruppe #CharmingKitten #FancyBear #Lazarus #SolarWinds https://sc.tarnkappe.info/db4898 -
📬 Die stille Gefahr: Wie APT-Gruppen Unternehmen infiltrieren
#Datenschutz #ITSicherheit #AdvancedPersistentThreats #APTGruppe #CharmingKitten #FancyBear #Lazarus #SolarWinds https://sc.tarnkappe.info/db4898 -
Happy Thursday everyone!
The Volexity team share their findings from a recent incident that involved the APT known as #CharmingKitten (aka #CharmingCypress) and what lengths this group went to make their attack look as convincing as possible. The Volexity team also shared technical details about the malware that was used, specific commands seen, and TTPs used. Enjoy and Happy Hunting!
CharmingCypress: Innovating Persistence
https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/As always, I don't want to leave you empty handed! So take this Community Hunt Package from Cyborg Security to help you identify discovery behavior from adversaries!
Excessive Windows Discovery and Execution Processes - Potential Malware Installation
https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday #gethunting
-
Happy Thursday everyone!
The Volexity team share their findings from a recent incident that involved the APT known as #CharmingKitten (aka #CharmingCypress) and what lengths this group went to make their attack look as convincing as possible. The Volexity team also shared technical details about the malware that was used, specific commands seen, and TTPs used. Enjoy and Happy Hunting!
CharmingCypress: Innovating Persistence
https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/As always, I don't want to leave you empty handed! So take this Community Hunt Package from Cyborg Security to help you identify discovery behavior from adversaries!
Excessive Windows Discovery and Execution Processes - Potential Malware Installation
https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday #gethunting
-
"🌪️ Mint Sandstorm: Sophisticated Phishing Campaign Unleashed by APT35 🚨"
Microsoft's security blog reveals an intricate phishing campaign, "Mint Sandstorm," by the subgroup PHOSPHORUS (also known as APT35 and Charming Kitten), linked to Iran's Islamic Revolutionary Guard Corps. This campaign targets individuals in universities and research organizations involved in Middle Eastern affairs across various countries. Unique tactics include bespoke phishing lures, using compromised legitimate email accounts, and deploying custom backdoors like MediaPl and MischiefTut. These tools allow for encrypted communications, reconnaissance, and persistence in target environments. Microsoft suggests using Attack Simulator in Defender for Office 365, enabling SmartScreen on browsers, and activating cloud-delivered protection to mitigate risks.
Tags: #CyberSecurity #Phishing #APT35 #CharmingKitten #MintSandstorm #MicrosoftSecurity #InfoSec #ThreatIntelligence
-
"🌪️ Mint Sandstorm: Sophisticated Phishing Campaign Unleashed by APT35 🚨"
Microsoft's security blog reveals an intricate phishing campaign, "Mint Sandstorm," by the subgroup PHOSPHORUS (also known as APT35 and Charming Kitten), linked to Iran's Islamic Revolutionary Guard Corps. This campaign targets individuals in universities and research organizations involved in Middle Eastern affairs across various countries. Unique tactics include bespoke phishing lures, using compromised legitimate email accounts, and deploying custom backdoors like MediaPl and MischiefTut. These tools allow for encrypted communications, reconnaissance, and persistence in target environments. Microsoft suggests using Attack Simulator in Defender for Office 365, enabling SmartScreen on browsers, and activating cloud-delivered protection to mitigate risks.
Tags: #CyberSecurity #Phishing #APT35 #CharmingKitten #MintSandstorm #MicrosoftSecurity #InfoSec #ThreatIntelligence
-
Iran's #CharmingKitten Pounces on Israeli #Exchange Servers
https://www.darkreading.com/dr-global/irans-charming-kitten-israeli-exchange-servers
-
Iran's #CharmingKitten Pounces on Israeli #Exchange Servers
https://www.darkreading.com/dr-global/irans-charming-kitten-israeli-exchange-servers
-
"🔍 Charming Kitten Strikes with 'Sponsor' Malware! 🕵️"
The notorious APT group 'Charming Kitten' (also known as Phosphorus, TA453, APT35/42) has unveiled a new backdoor malware named 'Sponsor'. This malware has already targeted 34 global companies. Stay vigilant! 🌍🔥A nation-state threat actor, known by various aliases including 'Charming Kitten,' 'Phosphorus,' 'TA453,' and 'APT35/42,' has recently executed a sophisticated cyber campaign using a previously undisclosed backdoor malware named 'Sponsor.' ESET researchers have identified this campaign, which targeted 34 companies worldwide between March 2021 and June 2022, encompassing government and healthcare organizations, financial services, engineering, manufacturing, technology, law, telecommunications, and more. The primary targets were located in Israel, Brazil, and the United Arab Emirates.
Key Findings:
Concealed Configuration Files: The 'Sponsor' backdoor is notable for its ability to hide configuration files on the victim's system, making it stealthy and difficult to detect. These files are deployed discreetly through malicious batch scripts.
Initial Access via Microsoft Exchange Vulnerability: The threat actor primarily exploited the CVE-2021-26855 vulnerability in Microsoft Exchange to gain initial access to targeted networks.
Tool Usage: Charming Kitten utilized various open-source tools for data exfiltration, system monitoring, network infiltration, and maintaining access to compromised computers.
Payload Deployment: Prior to deploying the 'Sponsor' backdoor, the attackers dropped batch files on specific file paths, creating seemingly innocuous files named config.txt, node.txt, and error.txt to avoid arousing suspicion.
Functionality of 'Sponsor' Backdoor: 'Sponsor' is a C++ backdoor that establishes a service upon launch based on instructions from the configuration file. The configuration file contains encrypted command and control (C2) server addresses, C2 contacting intervals, and the RC4 decryption key. The malware collects system information and sends it to the C2, receiving a unique node ID in return. It then enters a loop to receive and execute commands from the C2, including process ID reporting, command execution, file retrieval and execution, and more.
Disguised Second Version: ESET identified a second version of 'Sponsor' with code optimizations and camouflage features, making it appear as an updater tool.
Indicators of Compromise (IOCs): Although the IP addresses used in this campaign are no longer active, ESET has shared comprehensive IOCs to assist in defending against potential future threats that may reuse the tools or infrastructure deployed by Charming Kitten.
Organizations worldwide, particularly those in the targeted sectors and regions, should remain vigilant and ensure their cybersecurity defenses are up-to-date and capable of detecting advanced threats like 'Sponsor' used by nation-state actors like Charming Kitten. Regular patching and network monitoring are essential to mitigate such cyber risks.
Source: BleepingComputer.com
Mitre - Charming Kitten
Tags: #APT #CharmingKitten #SponsorMalware #CyberAttack -
"🔍 Charming Kitten Strikes with 'Sponsor' Malware! 🕵️"
The notorious APT group 'Charming Kitten' (also known as Phosphorus, TA453, APT35/42) has unveiled a new backdoor malware named 'Sponsor'. This malware has already targeted 34 global companies. Stay vigilant! 🌍🔥A nation-state threat actor, known by various aliases including 'Charming Kitten,' 'Phosphorus,' 'TA453,' and 'APT35/42,' has recently executed a sophisticated cyber campaign using a previously undisclosed backdoor malware named 'Sponsor.' ESET researchers have identified this campaign, which targeted 34 companies worldwide between March 2021 and June 2022, encompassing government and healthcare organizations, financial services, engineering, manufacturing, technology, law, telecommunications, and more. The primary targets were located in Israel, Brazil, and the United Arab Emirates.
Key Findings:
Concealed Configuration Files: The 'Sponsor' backdoor is notable for its ability to hide configuration files on the victim's system, making it stealthy and difficult to detect. These files are deployed discreetly through malicious batch scripts.
Initial Access via Microsoft Exchange Vulnerability: The threat actor primarily exploited the CVE-2021-26855 vulnerability in Microsoft Exchange to gain initial access to targeted networks.
Tool Usage: Charming Kitten utilized various open-source tools for data exfiltration, system monitoring, network infiltration, and maintaining access to compromised computers.
Payload Deployment: Prior to deploying the 'Sponsor' backdoor, the attackers dropped batch files on specific file paths, creating seemingly innocuous files named config.txt, node.txt, and error.txt to avoid arousing suspicion.
Functionality of 'Sponsor' Backdoor: 'Sponsor' is a C++ backdoor that establishes a service upon launch based on instructions from the configuration file. The configuration file contains encrypted command and control (C2) server addresses, C2 contacting intervals, and the RC4 decryption key. The malware collects system information and sends it to the C2, receiving a unique node ID in return. It then enters a loop to receive and execute commands from the C2, including process ID reporting, command execution, file retrieval and execution, and more.
Disguised Second Version: ESET identified a second version of 'Sponsor' with code optimizations and camouflage features, making it appear as an updater tool.
Indicators of Compromise (IOCs): Although the IP addresses used in this campaign are no longer active, ESET has shared comprehensive IOCs to assist in defending against potential future threats that may reuse the tools or infrastructure deployed by Charming Kitten.
Organizations worldwide, particularly those in the targeted sectors and regions, should remain vigilant and ensure their cybersecurity defenses are up-to-date and capable of detecting advanced threats like 'Sponsor' used by nation-state actors like Charming Kitten. Regular patching and network monitoring are essential to mitigate such cyber risks.
Source: BleepingComputer.com
Mitre - Charming Kitten
Tags: #APT #CharmingKitten #SponsorMalware #CyberAttack -
SecurityAffairs: Iranian Charming Kitten APT targets various entities in Brazil, Israel, and the U.A.E. using a new backdoor https://securityaffairs.com/150667/apt/charming-kitten-new-sponsor-backdoor.html #informationsecuritynews #ITInformationSecurity #PierluigiPaganini #SecurityAffairs #CharmingKitten #Cyberwarfare #Intelligence #SecurityNews #hackingnews #backdoor #Hacking #Malware #malware #APT
-
Sponsor, written in C++, is designed to gather crucial information from the compromised host and execute instructions received from the attackers’ remote server.
-
Sponsor, written in C++, is designed to gather crucial information from the compromised host and execute instructions received from the attackers’ remote server.
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
Hackmageddon: 1-15 July 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/22/1-15-july-2023-cyber-attacks-timeline/ #BelarusianStateUniversity #FrenchMinistryofJustice #CyberAttacksTimelines #UkrainianITArmy #Vulnerabilities #CharmingKitten #CVE-2023-34362 #CyberEspionage #CyberPartisans #HCAHealthcare #CyberAttacks #LazarusGroup #RodeoFinance #Ghostwriter #PolyNetwork #CyberCrime #Hacktivism #Multichain #NATOSummit #Ransomware #Storm-0558 #Indonesia #SiegedSec #Security #Timeline
-
📬 Spionage im Internet: Verfassungsschutz warnt vor Charming Kitten
#Cyberangriffe #Geheimdienste #Bundesverfassungsschutz #CharmingKitten #CyberSpionage #Cyberabwehr #DrMansourSohrabi #Iran #JadranMesic #MikeHart https://tarnkappe.info/artikel/cyberangriff/spionage-im-internet-verfassungsschutz-warnt-vor-charming-kitten-279835.html -
Verfassungsschutz: Iranische Hacker wollen Regimekritiker hierzulande ausspähen | heise online https://www.heise.de/news/Verfassungsschutz-Iranische-Hacker-wollen-Regimekritiker-hierzulande-ausspaehen-9240674.html #Phishing #CyberCrime #Hacking #SocialEngineneering #Iran 🇮🇷 #CharmingKitten
-
Nach Erkenntnissen des Bundesamtes für #Verfassungsschutz (#BfV) ist seit Ende 2022 von konkreten Ausspähversuchen der #APT-Gruppe #CharmingKitten gegen iranische Personen und Organisationen in Deutschland auszugehen.
Insbesondere warnt das BfV im "Cyber-Brief Nr. 01/2023" vom 10. August 23 vor #Phishing-Angriffen gegen #Dissidenten-Organisationen und Einzelpersonen – wie Juristen, Journalisten oder #Menschenrechtsaktivisten – innerhalb und außerhalb des #Iran.
-
From the @volexity #threatintel team: this blog post details #CharmingKitten's POWERSTAR malware, now with an InterPlanetary twist... Read more: https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/ #dfir
-
📬 PowerLess: Malware hat es jetzt auch auf Telegram-Daten abgesehen
#Cyberangriffe #Kurznotiert #Malware #APT35 #APT42 #CharmingKitten #CheckPointResearch #EducatedManticore #MintSandstorm #Phosphorus #PowerLess #TA453 #Telegram https://tarnkappe.info/artikel/it-sicherheit/malware/powerless-malware-hat-es-jetzt-auch-auf-telegram-daten-abgesehen-273696.html -
Charming Kitten targets critical infrastructure in US and elsewhere with BellaCiao malware https://www.tripwire.com/state-of-security/charming-kitten-targets-critical-infrastructure-us-and-elsewhere-bellaciao #criticalinfrastructure #CharmingKitten #Guestblog #Malware #Iran
-
Good day everyone! I hope everyone is enjoying their Wednesday!
In a recent report by Bitdefender Labs, they took a deep-dive into the threat group #CharmingKitten and their latest malware, #BellaCiao. It is a great read, but some main behaviors that I pulled from the report included:
#DefenseEvasion:
T1562.001 - Impair Defenses: Disable or Modify Tools
Charming Kitten used powershell to disable real-time monitoring on the machine to avoid detection.#Persistence:
T1053.005 - Scheduled Task/Job: Scheduled Task
They also created scheduled tasks to run on start and used the technique of masquerading their process names to blend in.#Execution:
The Bitdefender team provided the locations that the executables were written to.You should go and check out this #readoftheday, it contains great technical details that you can use to improve your threat hunting skill.
Enjoy and Happy Hunting!#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting
-
CW: Thoughts on new #TA453/CharmingKitten Blog
What happens when a TA’s consistent TTPs change? Today we (#CristaNeedsAMastadon and I) released a blog detailing examples of weird and wacky techniques and targeting from #TA453.
https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations
With the current situation (#MahsaAmini) in Iran, I think it’s important to note that the Government of Iran (GOI) has had an intelligence interest in Gender Studies and Women’s Rights experts since AT LEAST 2021.
If we want to see how high they rank in interest, we just need to look at how they likely deployed the same malware (GhostEcho/CharmPower) against some of those researchers and activists that they did against Foreign Government embassy personnel.
When we pivot to look at Samantha, you see a persona that’s targeted MENA energy, a US based academic that’s an Iranian HVT, and senior US & European government officials, all using confrontational lures not typically seen from TA453.
Is this an actor gone rogue, willing to do anything to successfully phish at any cost? Maybe. Is it the intern or conscriptee just trying to meet a quota?
We don’t know but it’s definitely interesting to track.
We talked about confrontational conversational phishing, but nothing really says confrontational like compromising multiple email accounts just to deliver a JPEG of intimidation to a target. That, along with the compromise of a close affiliate of one of the former officials targeted in the IRGC Murder For Hire plot, leads us to believe that a subset of TA453 activity is more aggressive than we’ve seen historically.
Please go read it! Let us know what you think. #APT #Iran #IRGC #APT42 #Phosphorus #charmingKitten
-
When talking to people, one of the biggest questions i get is what does #TA453/ #CharmingKitten do once they send their phishing links.
This is great work from @abirghattas!
https://www.hrw.org/news/2022/12/05/iran-state-backed-hacking-activists-journalists-politicians #Iran #APT
-
Most controversial opinions…
Avocados (and Guac) are gross.
Coffee is overrrated.
#APT35 is not #CharmingKitten. -
#introduction
I’m Josh/Yoshi.
I work as a Senior Threat Researcher hunting for state aligned cyber threat actors (aka APTs).
I focus on threats suspected of originating in the Middle East & North Africa Region, primarily Iranian aligned threats like #TA453 (#CharmingKitten), #TA450 (#Muddywater), and #TA456 (#Tortoiseshell).Before this, I did #threatIntel work in healthcare. Before that, I worked for the #FBI.
I live in Chicago(land) with 3 kids, 2 dogs and my beautiful wife.
I’m a huge fan of #StarWars and the #LAChargers
This seems like a pretty cool place, excited to see how it grows.