Charming Kitten is an Iranian state-linked espionage cluster that wins mostly by persuading people to hand over their passwords and second factors, not by exotic malware. It impersonates journalists, think-tank staff and conference organisers, spends days or weeks building rapport, and only then sends a credential phishing link. A related subgroup also exploits internet-facing servers within days of a public proof of concept. This profile is for security operations, threat intelligence and identity teams at organisations whose staff work on Middle East policy, government, academia, media, NGOs, energy or transport. It summarises the actor's names, targeting, ATT&CK techniques and identity abuse, and turns them into detections and controls. Facts are stated as of October 2026, based on sources available, and attribution follows the cautious wording of each source.
Key takeaways
- One label, several overlapping clusters. MITRE ATT&CK tracks the activity as Magic Hound (G0059); vendors use APT35, APT42, Mint Sandstorm, Phosphorus, TA453 and ITG18 for overlapping but not identical sets of operations.
- People are the primary target. Researchers, journalists, officials, campaign staff and NGO workers are approached through personal email, LinkedIn, WhatsApp and SMS, often on personal rather than corporate accounts.
- Rapport first, payload later. Microsoft and Google both describe a benign first message, followed by a link to a fake login page, a cloud-hosted document or an archive containing a disguised shortcut file.
- Weak second factors are bypassed, not avoided. Reported methods include phishing SMS codes, sending MFA push prompts until approved, and creating app-specific passwords for persistent mailbox access.
- Phishing-resistant MFA and fast patching remove most of the playbook. FIDO2 passkeys or security keys for high-risk people, plus rapid patching of internet-facing servers listed in the CISA KEV catalogue, address both halves of the group's tradecraft.
Who they are (names and aliases)
MITRE describes Magic Hound as an Iranian-sponsored group conducting long-term, resource-intensive espionage, likely on behalf of the Islamic Revolutionary Guard Corps (IRGC), active since at least 2014. Microsoft links Mint Sandstorm to the IRGC; Mandiant assesses that APT42 operates on behalf of the IRGC Intelligence Organization (IRGC-IO). Naming is messy because vendors split and merge clusters differently, so treat the table as a cross-reference, not a statement that every name is the same team.
| Name | Used by | Notes |
|---|---|---|
| Magic Hound (G0059) | MITRE ATT&CK | Associated groups: TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm |
| Charming Kitten | ClearSky, Certfa and common usage | The most widely recognised public name |
| APT35 | Mandiant, Google TAG | Google TAG reporting from 2021 uses APT35 |
| APT42 | Mandiant, Google | Mandiant lists overlaps with Charming Kitten, Mint Sandstorm/Phosphorus, TA453, Yellow Garuda, ITG18 and CALANQUE |
| Mint Sandstorm (formerly Phosphorus) | Microsoft | Microsoft notes overlap with APT35, APT42, Charming Kitten and TA453, and describes distinct subgroups |
| TA453 | Proofpoint | Email-focused tracking of the phishing operations |
| ITG18 | IBM X-Force | Listed by MITRE and Mandiant as overlapping |
For how actor naming schemes differ across vendors and how to use them in intelligence work, see the Threat Actor Groups Guide and the Threat Intelligence Guide.
Targeting and motivation
The motivation is intelligence collection that serves Iranian state priorities: foreign policy, regional security, nuclear issues, dissidents and elections. MITRE lists government and military personnel, academics, journalists and organisations such as the World Health Organization across Europe, the US and the Middle East.
- Policy and academia: Microsoft reported in January 2024 a campaign from November 2023 against people working on Middle Eastern affairs at universities and research organisations in Belgium, France, Gaza, Israel, the UK and the US, using lures about the Israel-Hamas war.
- Elections and campaigns: Google TAG reported APT35 targeting 2020 US campaign staff, and in August 2024 reported APT42 targeting roughly a dozen people linked to the Biden and Trump campaigns in May and June 2024, including a successful compromise of a political consultant's personal Gmail account.
- Hack and leak: In September 2024 the US Department of Justice charged three IRGC employees with a hack-and-leak operation against a 2024 presidential campaign, alleging fake email accounts in the names of prominent people, spoofed login pages and theft of MFA codes. The indictment does not use a vendor group name, so treat any link to a specific cluster as an analytic judgement.
- Infrastructure owners: Microsoft describes a Mint Sandstorm subgroup that targeted energy and transportation organisations by exploiting internet-facing applications.
- NGOs, legal and media: Mandiant's 2024 APT42 report adds NGOs, legal services, activists and media organisations in the US, UK, Israel and Europe.
Tactics and techniques (MITRE ATT&CK)
The mapping below uses ATT&CK v20 technique IDs with procedure examples drawn from MITRE's G0059 entry and the cited vendor reports.
| Tactic | Technique | Reported behaviour |
|---|---|---|
| Resource development | T1585.001 Social Media Accounts, T1585.002 Email Accounts | Fake LinkedIn and email personas impersonating journalists and researchers |
| Resource development | T1583.001 Domains | Look-alike domains for news outlets, think tanks and login pages |
| Resource development | T1586.002 Email Accounts (compromise) | Phishing sent from previously compromised legitimate accounts |
| Reconnaissance | T1598.003 Spearphishing Link | SMS and email links that harvest credentials or track recipients |
| Reconnaissance | T1589.001 Credentials | Credentials gathered from over 900 Fortinet VPN servers, and stolen passwords tested across 75 websites |
| Initial access | T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service | Links in email, LinkedIn and WhatsApp conversations |
| Initial access | T1190 Exploit Public-Facing Application | Log4Shell, Exchange ProxyShell, FortiOS SSL VPN, ManageEngine and Aspera Faspex flaws |
| Execution | T1204.002 Malicious File, T1059.001 PowerShell | Archives containing .pdf.lnk files that fetch VBS or PowerShell backdoors |
| Persistence | T1136.001 Local Account, T1036.010 Masquerade Account Name | Local accounts named help and DefaultAccount |
| Persistence | T1505.003 Web Shell, T1098.002 Additional Email Delegate Permissions | Web shells on Exchange; delegate read access to other mailboxes |
| Credential access | T1003.001 LSASS Memory | LSASS dumps used to obtain domain administrator credentials |
| Collection | T1114.002 Remote Email Collection | Mailbox exports from compromised Exchange servers |
| Command and control | T1090 Proxy | Fast Reverse Proxy tunnelling RDP traffic |
| Impact | T1486 Data Encrypted for Impact | BitLocker and DiskCryptor used to encrypt workstations in some intrusions |
How they abuse identities and credentials
Almost every phase of the group's work is an identity attack, which is why identity teams should own a share of the defence.
Impersonation and rapport building
- Borrowed credibility: Google TAG reported APT35 impersonating officials of the Munich Security Conference and the Think-20 Italy summit; Mandiant reported typosquatted domains for The Washington Post, The Economist and the Aspen Institute.
- Benign first contact: Microsoft and Google both describe an opening email with no link or a harmless PDF, followed by a move to Signal, Telegram or WhatsApp, which takes the conversation outside corporate email filtering. See the Deepfake and AI Impersonation Guide for verification habits that also help here.
Credential phishing and second factor bypass
- Fake login pages: Pages hosted on Google Sites, compromised university websites and look-alike domains mimic Google, Microsoft 365, Yahoo and Hotmail sign-in. Google TAG named the GCollection kit, which supports MFA prompts, and DWP, a browser-in-the-browser kit.
- MFA defeat: Mandiant reported that sending repeated push prompts succeeded where fake Duo pages failed, and that SMS codes were phished. These map to T1621 Multi-Factor Authentication Request Generation and T1111 Multi-Factor Authentication Interception. See the MFA Fatigue and Bypass Guide.
- Reconnaissance of recovery settings: Google TAG reported the actor checking which personal accounts lacked MFA and probing recovery options, then logging in from the target's location to avoid risk-based sign-in alerts.
Persistence through account features
- App-specific passwords: Google and Mandiant both report creation of app passwords after compromise. These bypass interactive MFA and survive a password change unless explicitly revoked.
- Recovery details: Changing the recovery email or phone lets the actor reclaim the account later.
- Mailbox delegation and local accounts: On-premises intrusions added delegate rights to other mailboxes, enabled the built-in DefaultAccount and created local accounts with names that look routine, an approach also described in joint advisory AA21-321A (accounts such as Support, Help and WADGUtilityAccount).
- Cloud exfiltration under a look-alike identity: Mandiant observed data sent to a OneDrive account named after the victim organisation on outlook.com.
Notable incidents
| Date (reported) | Activity | Source |
|---|---|---|
| 2020 to 2021 | APT35 phishing against 2020 US campaign staff; UK university website hijacked to host a phishing kit with a webinar lure; spyware disguised as a VPN app removed from Google Play before installs | Google TAG, October 2021 |
| November 2021 | Iranian government-sponsored actors exploiting ProxyShell (CVE-2021-34473) and FortiOS flaws including CVE-2018-13379; MITRE attributes the same CVE set to Magic Hound | FBI, CISA, ACSC and NCSC advisory AA21-321A |
| January to February 2023 | Mint Sandstorm subgroup exploited ManageEngine CVE-2022-47966 on the day its proof of concept appeared, and IBM Aspera Faspex CVE-2022-47986 within five days | Microsoft, April 2023 |
| November 2023 onward | Journalist impersonation against Middle East researchers, leading to .pdf.lnk files and the MediaPl and MischiefTut backdoors | Microsoft, January 2024 |
| 2024 | APT42 credential harvesting against NGOs, media and legal targets using NICECURL and TAMECAT backdoors and Microsoft 365 access | Mandiant, May 2024 |
| May to June 2024 | Targeting of US presidential campaign associates; personal Gmail of a political consultant compromised | Google TAG, August 2024 |
| September 2024 | Indictment of three IRGC employees for a hack-and-leak operation using spoofed login pages and MFA code theft | US Department of Justice |
All of the CVEs above are in the CISA Known Exploited Vulnerabilities catalogue. The pattern of VPN appliance exploitation leading to credential exposure is the same one seen in the Ivanti Connect Secure exploitation of 2024, by a different actor.
Detection and defence
Controls mapped to the playbook
| Actor behaviour | Control | Framework reference |
|---|---|---|
| Credential phishing, push fatigue, SMS code theft | FIDO2 passkeys or security keys for high-risk staff; enrol their personal Google accounts in Advanced Protection | NIST SP 800-53 IA-2, IA-5; CSF 2.0 PR.AA-03 |
| App passwords and recovery changes | Disable legacy authentication and app passwords; alert on recovery detail changes | SP 800-53 AC-2; CSF 2.0 DE.CM-01 |
| Exploitation of Exchange, VPN and ManageEngine | Patch KEV-listed flaws on internet-facing assets in days, not weeks | SP 800-53 RA-5, SI-2; CSF 2.0 ID.RA-01 |
| Local accounts, DefaultAccount, LSASS dumps | Monitor account creation and group changes; LSASS protection; least privilege | SP 800-53 AC-2, AC-6, SI-4 |
| Impersonation via personal channels | Targeted awareness for high-risk roles on verifying unsolicited contacts | SP 800-53 AT-2; CSF 2.0 PR.AT-01 |
| New intelligence on the actor | Consume government and vendor reporting; update detections | SP 800-53 PM-16; CSF 2.0 ID.RA-02 |
What to log and hunt for
- Windows account events: Event ID 4720 (account created), 4722 (account enabled, watch DefaultAccount), 4732 (member added to a local group such as Administrators or Remote Desktop Users).
- Exchange and Microsoft 365: New-MailboxExportRequest and Add-MailboxPermission in the admin audit log; new inbox rules; sign-ins from mail clients such as Thunderbird that the user does not normally use; app password creation.
- Endpoints: .lnk files launched from archives that spawn curl, wscript or powershell; new Run key values; scheduled tasks pulling .txt files. Microsoft recommends attack surface reduction rules that block JavaScript or VBScript from launching downloaded executable content and block execution of potentially obfuscated scripts.
- Network: connections to newly registered look-alike domains, to free hosting and URL shorteners from mail links, and outbound tunnelling consistent with Fast Reverse Proxy.
Hunting ideas are expanded in the Threat Hunting Guide; protecting appliances is covered in the Edge Device Security Guide.
Metrics
- Percentage of high-risk staff (policy, leadership, communications, researchers) on phishing-resistant MFA, for both corporate and personal accounts where the organisation supports it.
- Median days to patch internet-facing KEV vulnerabilities.
- Number of active app passwords and legacy-authentication sign-ins (target: zero).
- Time from a user reporting a suspicious contact to password reset and session revocation.
- Share of reported impersonation attempts from staff versus those found by tooling.
Practitioner checklist
- Build a register of high-risk individuals (policy, Middle East work, journalists, executives, campaign roles) and give them phishing-resistant MFA first. See the Phishing-Resistant MFA Guide.
- Encourage those individuals to protect personal email with security keys or Google Advanced Protection, which also revokes app-specific passwords.
- Disable app passwords and legacy authentication in Microsoft 365 and Google Workspace, and alert on recovery detail changes.
- Patch internet-facing Exchange, VPN and management servers against KEV entries within days, and review appliance logs after patching.
- Alert on local account creation, DefaultAccount activation, mailbox export requests and new mailbox delegation.
- Enable attack surface reduction rules for script and shortcut-based delivery, and block .lnk and script files inside archives at the mail gateway.
- Teach staff to verify unsolicited interview, conference and article requests through a known channel before clicking any link, even after a friendly first exchange.
- On suspected compromise, reset passwords, revoke sessions, remove app passwords, restore recovery details and review delegation, following the Phishing Incident Response Playbook.
Standards and references
- MITRE ATT&CK: Magic Hound (G0059)
- CISA, FBI, ACSC and NCSC: Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities (AA21-321A)
- US Department of Justice: Three IRGC Cyber Actors Indicted for Hack-and-Leak Operation
- Microsoft Threat Intelligence: New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals
- Microsoft Threat Intelligence: Mint Sandstorm refines tradecraft to attack high-value targets
- Mandiant: Untangling Iran's APT42 operations
- Google TAG: Iranian-backed group steps up phishing campaigns against Israel and the US
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Threat Actor Groups Guide · AiTM Phishing Guide · Mobile Device Security Guide · Executive Protection and Digital Footprint Guide