Hacker WhoIs: Charming Kitten Alleged Iran State Sponsored Hackers
1Charming Kitten (other aliases include APT35 (by Mandiant), Phosphorus (by Microsoft),[1] Ajax Security (by FireEye),[2] NewsBeef (by Kaspersky,[3]))[4] is a cyberwarfare group, described by several companies and government officials as an advanced persistent threat.
On December 15, 2017 the group was designated by FireEye as a nation state based advanced persistent threat, regardless of the lack of its sophistication. Research conducted by FireEye in 2018 suggested that APT35 may be expanding their malware, and solidifying[clarification needed] their campaigns.[5]
The group has since been known to use phishing to impersonate company websites,[6], as well as fake accounts and fake DNS domains to phish users' passwords.
Contents
1 History
1.1 Witt Defection (Early 2013)
1.2 HBO cyberattack (2017)
1.3 Second Indictment (2019)
1.4 2020 Election interference attempts (2019)
2 See also
3 References
History
Witt Defection (Early 2013)
In 2013 former United States Air Force technical sergeant and military intelligence defense contractor Monica Witt defected to Iran knowing she might incur criminal charges by the United Stages for doing so.[citation needed] Her giving of intelligence to the government of Iran later caused Operation Saffron Rose, a cyberwarfare operation that targeted US military contractors.[citation needed]
HBO cyberattack (2017)
In 2017, following a cyberattack on HBO, a large-scale joint investigation was launched[by whom?] on the grounds that confidential information was being leaked. A conditional statement by a hacker going by alias Skote Vahshat said that if money was not paid, scripts of television episodes, including episodes of Game of Thrones, would be leaked. The hack caused a leak of 1.5 terabytes of data, some of which was shows and episodes that had not been broadcast at the time.[7] HBO has since stated that it would take steps to make sure that they would not be breached again.[8]
Behzad Mesri was subsequently indicted for the hack. He has since been alleged to be part of the operation unit that had leaked confidential information. [9]
According to Certfa, Charming Kitten had targeted US officials involved with the 2015 Iran Nuclear Deal. The Iranian government denied any involvement.[10][11]
Second Indictment (2019)
Witt was officially charged by a Washington, D.C. based jury on February 19, 2019.[12] Four others including the HBO hacker were also charged.[citation needed]
A court order was issued[by whom?] authorizing Microsoft to take ownership of 99 DNS domains that were registered by the group. Microsoft has subsequently said that it plans to work to reduce the cyberattack rate significantly.
Charming Kitten
https://en.wikipedia.org/wiki/Charming_Kitten
Monica Witt
https://en.wikipedia.org/wiki/Monica_Witt
Monica Witt Story
https://www.bbc.com/news/world-us-canada-47231777
Operation Saffrom Rose 2013
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf
Computer Crackers Cracking WHO
https://www.reuters.com/article/us-health-coronavirus-cyber-iran-exclusi/exclusive-hackers-linked-to-iran-target-who-staff-emails-during-coronavirus-sources-idUSKBN21K1RC
HBO Intrusion
https://www.vox.com/2017/8/5/16095560/hbo-hack-details-game-of-thrones
Reminder of Goverment Backed Phishing
https://security.googleblog.com/2018/08/a-reminder-about-government-backed.html