CharmingCypress: Innovating Persistence

Through its managed security services offerings, Volexity routinely identifies spear-phishing campaigns targeting its customers. One persistent threat actor, whose campaigns Volexity frequently observes, is the Iranian-origin threat actor CharmingCypress (aka Charming Kitten, APT42, TA453). Volexity assesses that CharmingCypress is tasked with collecting political intelligence against foreign targets, particularly focusing on think tanks, NGOs, and journalists.

In their phishing campaigns, CharmingCypress often employs unusual social-engineering tactics, such as engaging targets in prolonged conversations over email before sending links to malicious content. …

actor apt42 campaigns charming kitten collecting customers intelligence iranian journalists managed managed security managed security services ngos origin persistence persistent persistent threat phishing phishing campaigns political security security services services ta453 targeting think tanks threat threat actor volexity