Charming Kitten
Модный мишка | |
Formation | c. 2004–2007[1] |
---|---|
Type | Advanced persistent threat |
Purpose | Cyberespionage, cyberwarfare |
Region | Middle East |
Methods | Zero-days, spearphishing, malware, Social Engineering, Watering Hole |
Membership | At least 5 |
Official language | Persian |
Parent organization | IRGC |
Affiliations | Rocket Kitten APT34 APT33 |
Formerly called | APT35 Turk Black Hat Ajax Security Team Phosphorus |
Charming Kitten, also called APT35 (by Mandiant), Phosphorus or Mint Sandstorm (by Microsoft),[1] Ajax Security (by FireEye),[2] and NewsBeef (by Kaspersky[3][4]), is an Iranian government cyberwarfare group, described by several companies and government officials as an advanced persistent threat.
On December 15, 2017, the group was designated by FireEye as a nation state-based advanced persistent threat, regardless of the lack of its sophistication. Research conducted by FireEye in 2018 suggested that APT35 may be expanding their malware capabilities and intrusion campaigns.[5]
The group has since been known to use phishing to impersonate company websites,[6] as well as fake accounts and fake DNS domains to phish users' passwords.
History
[edit]Witt Defection (Early 2013)
[edit]In 2013, former United States Air Force technical sergeant and military intelligence defense contractor Monica Witt defected to Iran[7] knowing she might incur criminal charges by the United States for doing so.[citation needed] Her giving of intelligence to the government of Iran later caused Operation Saffron Rose, a cyberwarfare operation that targeted US military contractors.[citation needed]
HBO cyberattack (2017)
[edit]In 2017, following a cyberattack on HBO, a large-scale joint investigation was launched[by whom?] on the grounds that confidential information was being leaked. A conditional statement by a hacker going by alias Sokoote Vahshat (Persian سکوت وحشت lit. 'Silence of Fear') said that if money was not paid, scripts of television episodes, including episodes of Game of Thrones, would be leaked. The hack caused a leak of 1.5 terabytes of data, some of which was shows and episodes that had not been broadcast at the time.[8] HBO has since stated that it would take steps to make sure that they would not be breached again.[9]
Behzad Mesri was subsequently indicted for the hack. He has since been alleged to be part of the operation unit that had leaked confidential information.[10]
According to Certfa, Charming Kitten had targeted US officials involved with the 2015 Iran Nuclear Deal. The Iranian government denied any involvement.[11][12]
Second Indictment (2019)
[edit]A federal grand jury in the United States District Court for the District of Columbia indicted Witt on espionage charges (specifically "conspiracy to deliver and delivering national defense information to representatives of the Iranian government"). The indictment was unsealed on February 19, 2019. In the same indictment, four Iranian nationals—Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar—were charged with conspiracy, attempting to commit computer intrusion, and aggravated identity theft, for a campaign in 2014 and 2015 that sought to compromise the data of Witt's former co-workers.[13]
In March 2019, Microsoft took ownership of 99 DNS domains owned by the Iranian government-sponsored hackers, in a move intended to decrease the risk of spear-phishing and other cyberattacks.[14]
2020 Election interference attempts (2019)
[edit]According to Microsoft, in a 30-day period between August and September 2019, Charming Kitten made 2,700 attempts to gain information regarding targeted email accounts.[15] This resulted in 241 attacks and 4 compromised accounts. Although the initiative was deemed to have been aimed at a United States presidential campaign, none of the compromised accounts were related to the election.
Microsoft did not reveal who specifically was targeted, but a subsequent report by Reuters claimed it was Donald Trump's re-election campaign.[16] This assertion is corroborated by the fact that only the Trump campaign used Microsoft Outlook as an email client.
Iran denied any involvement in election meddling, with the Iranian Foreign Minister Mohammad Javad Zarif stating "We don’t have a preference in your election [the United States] to intervene in that election," and "We don’t interfere in the internal affairs of another country," in an interview on NBC's "Meet The Press".[17]
Cybersecurity experts at Microsoft and third-party firms such as ClearSky Cyber Security maintain that Iran, specifically Charming Kitten, was behind the attempted interference, however. In October 2019, ClearSky released a report supporting Microsoft's initial conclusion.[18] In the report, details about the cyberattack were compared to those of previous attacks known to originate from Charming Kitten. The following similarities were found:
- Similar victim profiles. Those targeted fell into similar categories. They were all people of interest to Iran in the fields of academia, journalism, human rights activism, and political opposition.
- Time overlap. Verified Charming Kitten activity was ramping up within the same timeframe that the election interference attempts were made.
- Consistent attack vectors. The methods of attack were similar, with the malicious agents relying on spear-phishing via SMS texts.
2022 HYPERSCRAPE, APT data extraction tool (2021)
[edit]On August 23, 2022, a Google Threat Analysis Group (TAG) blog post revealed a new tool developed by Charming Kitten to steal data from well-known email providers (i.e. Google, Yahoo!, and Microsoft).[19] This tool needs the target's credentials to create a session on its behalf. It acts in such a way that using old-style mail services looks normal to the server and downloads the victim's emails, and does some changes to hide its fingerprint.
Per the report, the tool is developed on the windows platform but not for the victim's machine. It uses both command line and GUI to enter credentials or other required resources like cookies.
See also
[edit]References
[edit]- ^ "Microsoft uses court order to shut down APT35 websites". CyberScoop. March 27, 2019.
- ^ "Ajax Security Team lead Iran-based hacking groups". Security Affairs. May 13, 2014.
- ^ "Freezer Paper around Free Meat". securelist.com. April 27, 2016.
- ^ Bass, Dina. "Microsoft Takes on Another Hacking Group, This One With Links to Iran". news.bloomberglaw.com.
- ^ "OVERRULED: Containing a Potentially Destructive Adversary". FireEye.
- ^ "Iranian Charming Kitten ATP group poses as Israeli cybersecurity firm in phishing campaign". Security Affairs. July 3, 2018.
- ^ Blinder, Alan; Turkewitz, Julie; Goldman, Adam (February 16, 2019). "Isolated and Adrift, an American Woman Turned Toward Iran". The New York Times. ISSN 0362-4331. Retrieved April 23, 2022.
- ^ "The HBO hack: what we know (and what we don't) - Vox". August 5, 2017.
- ^ Petski, Denise (July 31, 2017). "HBO Confirms It Was Hit By Cyber Attack".
- ^ "HBO Hacker Was Part of Iran's "Charming Kitten" Elite Cyber-Espionage Unit". BleepingComputer.
- ^ "Iranian Hackers Target Nuclear Experts, US Officials". Dark Reading. December 15, 2018.
- ^ Satter, Raphael (December 13, 2018). "AP Exclusive: Iran hackers hunt nuclear workers, US targets". AP NEWS.
- ^ "Former U.S. Counterintelligence Agent Charged With Espionage on Behalf of Iran; Four Iranians Charged With a Cyber Campaign Targeting Her Former Colleagues" (Press release). United States Department of Justice, Office of Public Affairs. February 13, 2019.
- ^ "Microsoft seizes 99 domains owned by Iranian state hackers". News @ WebHosting.info. March 28, 2019.
- ^ "Recent cyberattacks require us all to be vigilant". Microsoft On the Issues. October 4, 2019. Retrieved December 10, 2020.
- ^ Bing, Christopher; Satter, Raphael (October 4, 2019). "Exclusive: Trump campaign targeted by Iran-linked hackers - sources". Reuters.
- ^ AP. "Iran denies US election meddling, claims it has no preference". www.timesofisrael.com. Retrieved December 10, 2020.
- ^ "The Kittens Are Back in Town 2" (PDF). ClearSky Cyber Security. October 2019.
- ^ Bash, Ajax (August 23, 2022). "New Iranian APT data extraction tool". Threat Analysis Group (TAG).
- Embassy of Iran, Washington, D.C.
- Ambassadors of Iran to the United States
- Embassy of the United States, Tehran
- Ambassadors of the United States to Iran
- Interests Section of Iran in the United States
- Consulate-General of the United States, Tabriz
- Bureau of Near Eastern Affairs
- Iran–United States Claims Tribunal
- Iranian Directorate
- Iran Syria Policy and Operations Group
- Persian Corridor
- Persian Gulf Command
- Nationalization of the Iranian oil industry
- 1953 Iranian coup d'état
- Treaty of Amity, Economic Relations and Consular Rights
- Exercise Delawar
- Project Dark Gene
- Safari Club
- Island of Stability
- Mahmoud Ahmadinejad's letter to George W. Bush
- Correspondence between Barack Obama and Ali Khamenei
- Phone conversation between Barack Obama and Hassan Rouhani
- Joint Comprehensive Plan of Action
- Assassination of Paul R. Shaffer and John H. Turner
- Iranian Revolution
- Iran hostage crisis
- Beirut barracks bombings
- Khobar Towers bombing
- Lawrence Franklin espionage scandal
- Disappearance of Robert Levinson
- United States kill or capture strategy in Iraq
- United States raid on the Iranian Liaison Office in Erbil
- Kidnapping of Jalal Sharafi
- 2008 Naval dispute
- Project Cassandra
- Detention of American hikers
- United States diplomatic cables leak
- 2011 alleged Iran assassination plot
- Strait of Hormuz dispute
- RQ-170 incident
- MV Maersk Tigris
- 2016 Naval incident
- Nuclear program of Iran
- Kidnapping of Hossein Alikhani
- Arrest of Meng Wanzhou
- Deportation of Iranian students at US airports
- May 2019 Gulf of Oman incident
- June 2019 Gulf of Oman incident
- 2019 Iranian shoot-down of American drone
- 2019 K-1 Air Base attack
- December 2019 United States airstrikes in Iraq and Syria
- Attack on the United States embassy in Baghdad
- 2020 Iran explosions
- 2021 Erbil rocket attacks
- 2021 Natanz incident
- Leaked Mohammad Javad Zarif audiotape
- June 2021 United States airstrike in Syria
- July 2021 Gulf of Oman incident
- August 2021 Gulf of Oman incident
- 2021 U.S.–Iran naval incident
- 2022 Erbil missile attacks
- 2023 Northeastern Syria clashes
- Seizure of Suez Rajan and St Nikolas
- Attacks on U.S. bases in Iraq, Jordan, and Syria (2023–present)
- 2024 Erbil attack
- Tower 22 drone attack
- Iranian interference in the 2024 United States elections
- United States sanctions against Iran
- Executive Order 12170
- Executive Order 12172
- Executive Order 13769
- Executive Order 13780
- Executive Order 13876
- Iran and Libya Sanctions Act
- Iran Nonproliferation Act
- Iran, North Korea, Syria Nonproliferation Act
- Iran Freedom and Support Act
- Iran Sanctions Enhancement Act
- Kyl–Lieberman Amendment
- Comprehensive Iran Sanctions, Accountability, and Divestment Act
- Iran Freedom and Counter-Proliferation Act
- Public Law 113-100
- Iran Nuclear Agreement Review Act
- Countering America's Adversaries Through Sanctions Act
- Dames & Moore v. Regan
- United States Diplomatic and Consular Staff in Tehran
- Oil Platforms case
- United States v. Banki
- Bank Markazi v. Peterson
- Certain Iranian Assets
- Rubin v. Islamic Republic of Iran
- Alleged violations of Treaty of Amity
- Iran Action Group
- Iran–America Society
- Iranian Students Association in the United States
- National Iranian American Council
- Organization of Iranian American Communities
- Public Affairs Alliance of Iranian Americans
- United Against Nuclear Iran
- Farashgard
- Islamic Revolutionary Guard Corps
- Jundallah
- Kingdom Assembly of Iran
- National Council of Iran
- National Council of Resistance of Iran
- Elliott Abrams
- Howard Baskerville
- William J. Fallon
- Brian Hook
- Joseph Macmanus
- Robert Malley
- Stephen D. Mull
- Jon Pattis
- Erwin David Rabhan
- Jason Rezaian
- Scott Ritter
- Craig Wadsworth
- Michael R. White
- Roxana Saberi
- Saeed Abedini
- Saeid Aboutaleb
- Shahram Amiri
- Sirous Asgari
- Mahmoud Reza Banki
- Haleh Esfandiari
- Amir Mirza Hekmati
- Ezedin Abdel Aziz Khalil
- Shahrzad Mirgholikhan
- Mohammad Hosseini
- Esha Momeni
- Mohammad Mosaddegh
- Baquer Namazi
- Siamak Namazi
- Sahar Nowrouzzadeh
- Reza Pahlavi, Crown Prince of Iran
- Noor Pahlavi
- Trita Parsi
- Maryam Rajavi
- Abdolreza Shahlaei
- Ali Shakeri
- Masoud Soleimani
- Morad Tahbaz
- Kian Tajbakhsh
- Karan Vafadari
- Xiyue Wang
- Nizar Zakka
- Iranian Guantanamo Bay detainees
- 1998 FIFA World Cup match
- Academic relations between Iran and the United States
- American Islam
- Anti-American sentiment in Iran
- Axis of evil
- CIA activities in Iran
- Copyright relations
- Death to America
- Dual containment
- Great Satan
- International Conference on Hollywoodism
- Iran and state-sponsored terrorism
- Iranian frozen assets
- Opposition to military action against Iran
- Our enemy is here, they are lying that it is America
- State Sponsor of Terrorism
- United States involvement in regime change
- United States and state-sponsored terrorism
- 650 Fifth Avenue
- Alborz High School
- American Institute of Iranian Studies
- American School of Isfahan
- Community School, Tehran
- Damavand College
- Iran Bethel School
- Iranzamin School
- Saint Peter Church, Tehran
- Tehran American School
- "Bomb Iran"
- Overthrow
- Not for the Faint of Heart