Charming Kitten
-
MuddyWater launches Operation Olalampo targeting MENA with new Rust backdoor and loaders
A technical analysis by Group-IB found Iranian-linked MuddyWater launched Operation Olalampo on January 26, 2026 targeting MENA organisations. The campaign uses downloaders GhostFetch and HTTP_VIP, Rust backdoor CHAR and GhostBackDoor.
-
Proofpoint links new UNK_SmudgedSerpent cluster to targeted phishing of Iran experts
Proofpoint has identified a new threat cluster, UNK_SmudgedSerpent, that used political lures, impersonation and malicious installers to target academics and Iran policy experts between June and August 2025, deploying RMM tools including PDQ Connect and possibly ISL Online.
-
Iranian Hacking Group Targets Israeli Cybersecurity Experts in Spear-Phishing Campaign
Charming Kitten, a state-sponsored Iranian hacking group, has launched a spear-phishing campaign targeting cybersecurity experts in Israel, employing sophisticated tactics to establish credibility and facilitate information theft.
