IRIran (Islamic Republic of)confidence: 50G0058
Charming KittenCharming Kitten
Also known as: Newscaster · Parastoo · iKittens · Group 83 · NewsBeef · G0058 · CharmingCypress · Mint Sandstorm · Charming Kitten
Origin
IR
Known aliases
9
Target sectors
2
Attribution
State-sponsored
Profile
Charming Kitten is a Iranian-attributed threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). The group is also tracked as Newscaster, Parastoo, iKittens (and 5 more). Operational targeting focuses on the Government and Military sectors. Documented victim organisations include U.S. government/defense sector websites, Saudi Arabia, Israel and 2 other named victims. Original record: Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors.
Aliases· 9
NewscasterParastooiKittensGroup 83NewsBeefCharmingCypressMint SandstormCharming Kitten
Target sectors· 2
GovernmentMilitary
Known victims· 5
- U.S. government/defense sector websites
- Saudi Arabia
- Israel
- Iraq
- United Kingdom
MITRE ATT&CK Group crosswalk
References
- https://en.wikipedia.org/wiki/Operation_Newscaster
- https://iranthreats.github.io/resources/macdownloader-macos-malware/
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.05.28.NewsCaster_An_Iranian_Threat_Within_Social_Networks/file-2581720763-pdf.pdf
- https://www.forbes.com/sites/thomasbrewster/2017/07/27/iran-hackers-oilrig-use-fake-personas-on-facebook-linkedin-for-cyberespionage/
- https://cryptome.org/2012/11/parastoo-hacks-iaea.htm
- https://securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf
- https://securelist.com/blog/software/74503/freezer-paper-around-free-meat/
- https://www.verfassungsschutz.de/download/broschuere-2016-10-bfv-cyber-brief-2016-04.pdf
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.