apt

BellaCiao operators (Charming Kitten-linked)

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Charming KittenAPT35Magic HoundPhosphorusMint Sandstorm

Attribution

Iran — IRGC-aligned (Charming Kitten cluster)

Origin

Iran

First seen

2023

Last active

2024

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Israel, Turkey (MENA subset of a wider campaign; source also lists Austria, India, Italy, and US/Europe victims)

Sectors

Cross-sector

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel, Turkey (MENA subset of a wider campaign; source also lists Austria, India (Cross-sector sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BladedFelineactorTechnique overlap
WarlockactorTechnique overlap
Nemesis KittenactorTechnique overlap
Scarred Manticore (Storm-0861)actorTechnique overlap
Fox KittenactorTechnique overlap
Tropic TrooperactorTechnique overlap
OilRig (APT34)actorTechnique overlap
APT39 / ChaferactorTechnique overlap

Uses

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?