apt

Charming Kitten / APT42

active · last signal 6mo agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

APT / State-sponsored

APT42Charming KittenMint SandstormTA453Educated ManticoreMagic HoundPhosphorus

Attribution

Iran — Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO)

Origin

Iran

First seen

2015

Last active

2026

Motivation

Espionage

Attribution confidence

high

MENA targeting

Israel, Gulf states, broader Middle East

Sectors

Government, media, NGOs, academia, dissidents/activists

MITRE ATT&CK

G1044 ↗

Why it mattersState-sponsored / APT actor, high confidence, documented targeting Israel, Gulf states, broader Middle East (Government, media, NGOs sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

OilRig (APT34)actorTechnique overlap
HEXANE (Lyceum)actorTechnique overlap
MuddyWateractorTechnique overlap
WIRTEactorTechnique overlap
Stealth FalconactorTechnique overlap
Dust SpecteractorTechnique overlap
SideWinderactorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap
Cl0p

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Charming Kitten / APT42's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

14 / 32

Mean robustness (of covered)

2.1

Useful?

APT33actorTechnique overlap

BahamutactorTechnique overlap

APT39 / ChaferactorTechnique overlap

Qilin (fka Agenda)actorTechnique overlap

Gaza Cybergang / MoleratsactorTechnique overlap

Imperial Kitten (CURIUM)actorTechnique overlap

Tropic TrooperactorTechnique overlap

Nemesis KittenactorTechnique overlap

Earth BogleactorTechnique overlap

Fox KittenactorTechnique overlap

LockBit / LockBit 3.0actorTechnique overlap

Crypto24actorTechnique overlap

miniFlame (SPE)actorTechnique overlap

Sea TurtleactorTechnique overlap

ALPHV / BlackCatactorTechnique overlap

MedusaactorTechnique overlap

Scarred Manticore (Storm-0861)actorTechnique overlap

2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=enreportORKL2026-03-25

2025 November GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsreportORKL2025-11-05

Mandiant M-Trends 2025 ReportreportORKL2025-04-24

Iranian "Dream Job" campaignreportORKL2024-11-12

ESET APT Activity Report Q2 2024-Q3 2024reportORKL2024-11-07

GreenCharlie Infrastructure Linked to US Political Campaign TargetingreportORKL2024-08-19

Iran steps into US election 2024 with cyber-enabled influence operationsreportORKL2024-08-06

Israel-Hamas War in Cyber February 2024 Tool of First ResortreportORKL2024-02-08

2023 Adversary Infrastructure ReportreportORKL2024-01-08

2023 State of The Threat – A Year in ReviewreportORKL2023-09-29

The Human Factor 2023reportORKL2023-06-07

Uses

Boot or Logon Autostart ExecutiontechniqueATT&CK mapping

+31 more relationships — see the relationships browser.