GreenCharlie

Also known as: GreenCharlie

(Recorded Future) In August 2024, open sources revealed that US political campaign officials and affiliates were targeted as part of Mint Sandstorm and ‘APT 42’ operations. In this report, we discuss threat activity associated with the Iran-nexus group we track as GreenCharlie, which overlaps with ‘Magic Hound, APT 35, Cobalt Illusion, Charming Kitten’. Recorded Future has tracked Iran-linked GreenCharlie activity and malicious infrastructure since 2020. Our global Network Intelligence capability has allowed us to identify and track a large and rapidly evolving cluster of infrastructure used to support GreenCharlie cyber-espionage campaigns. Now, we have been able to link this network to the recent targeting of US political campaigns.

🌍 Country ["Iran"]

Introduction

(Recorded Future) In August 2024, open sources revealed that US political campaign officials and affiliates were targeted as part of Mint Sandstorm and ‘APT 42’ operations. In this report, we discuss threat activity associated with the Iran-nexus group we track as GreenCharlie, which overlaps with ‘Magic Hound, APT 35, Cobalt Illusion, Charming Kitten’. Recorded Future has tracked Iran-linked GreenCharlie activity and malicious infrastructure since 2020. Our global Network Intelligence capability has allowed us to identify and track a large and rapidly evolving cluster of infrastructure used to support GreenCharlie cyber-espionage campaigns. Now, we have been able to link this network to the recent targeting of US political campaigns.

Activities and Tactics

Country of Origin: 🇮🇷 [“Iran”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • GORBLE
  • NOKNOK
  • POWERSTAR
  • TAMECAT
  • GORBLE:
  • NOKNOK:
  • POWERSTAR:
  • TAMECAT:

Attribution and Evidence

Country of Origin: [“Iran”] Additional attribution information pending cataloguing.

References

References pending cataloguing.