- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Islamic Revolutionary Guard Corps (IRGC)
- Motivation
- Information theft and espionage
- Seen
- 2020
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0739 · greencharlie
IranWhat it is
(Recorded Future) In August 2024, open sources revealed that US political campaign officials and affiliates were targeted as part of Mint Sandstorm and 'APT 42' operations. In this report, we discuss threat activity associated with the Iran-nexus group we track as GreenCharlie, which overlaps with 'Magic Hound, APT 35, Cobalt Illusion, Charming Kitten'. Recorded Future has tracked Iran-linked GreenCharlie activity and malicious infrastructure since 2020. Our global Network Intelligence capability has allowed us to identify and track a large and rapidly evolving cluster of infrastructure used to support GreenCharlie cyber-espionage campaigns. Now, we have been able to link this network to the recent targeting of US political campaigns.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- ThreatActor.info (Malpedia et al.)Iran
Targets
- Countries
- United States
Tools
The tools and malware families the sources tie to it.
- GORBLE
- NOKNOK
- POWERSTAR
- TAMECAT
Sources
- ETDA Threat Group Card apt.etda.or.th