Charming Kitten
Charming Kitten (other aliases include APT35 (by Mandiant), Phosphorus (by Microsoft), Ajax Security (by FireEye), NewsBeef (by Kaspersky,)) is an Iranian government cyberwarfare group, described by several companies and government officials as an advanced persistent threat. On December 15, 2017 the group was designated by FireEye as a nation state-based advanced persistent threat, regardless of the lack of its sophistication. Research conducted by FireEye in 2018 suggested that APT35 may be expanding their malware capabilities and intrusion campaigns. The group has since been known to use phishing to impersonate company websites, as well as fake accounts and  fake DNS domains to phish users' passwords. History. Witt Defection (Early 2013). In 2013, former United States Air Force technical sergeant and military intelligence defense contractor Monica Witt defected to Iran knowing she might incur criminal charges by the United Stages for doing so. Her giving of intelligence to the government of Iran later caused Operation Saffron Rose, a cyberwarfare operation that targeted US military contractors. HBO cyberattack (2017). In 2017, following a cyberattack on HBO, a large-scale joint investigation was launched on the grounds that confidential information was being leaked. A conditional statement by a hacker going by  alias Sokoote Vahshat (Persian سکوت وحشت lit. "Silence of Fear") said that if money was not paid, scripts of television episodes, including episodes of "Game of Thrones", would be leaked. The hack caused a leak of 1.5 terabytes of data, some of which was shows and episodes that had not been broadcast at the time. HBO has since stated that it would take steps to make sure that they would not be breached again. Behzad Mesri was subsequently indicted for the hack. He has since been alleged to be part of the operation unit that had leaked confidential information. According  to Certfa, Charming Kitten had targeted US officials involved with the 2015 Iran Nuclear Deal. The Iranian government denied any involvement. Second Indictment (2019). A federal grand jury in the United States District Court for the District of Columbia indicted Witt on espionage charges (speciifcally "conspiracy to deliver and delivering national defense information to representatives of the Iranian government"). The indictment was unsealed on February 19, 2019. In the same indictment, four Iranian nationals—Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar—were charged with conspiracy, attempting to commit computer intrusion, and aggravated identity theft, for a campaign in  2014 and 2015 that sought to compromise the data of Witt's former co-workers. On March 2019, Microsoft took ownership of 99 DNS domains owned by the Iranian government-sponsored hackers, in a move intended to decrease the risk of spear-phishing and other cyberattacks. 2020 Election interference attempts (2019). According to Microsoft, in a 30-day period between August and September 2019, Charming Kitten made 2,700 attempts to gain information regarding targeted email accounts. This resulted in 241 attacks and 4 compromised accounts. Although the initiative was deemed to have been aimed at a United States presidential campaign , none of the compromised accounts were related to the election. Microsoft did not reveal who specifically was targeted, but a subsequent report by Reuters claimed it was Donald Trump's re-election campaign. This assertion is corroborated by the fact that only the Trump campaign used Microsoft Outlook as an email client. Iran denied any involvement in election meddling, with the Iranian Foreign Minister Mohammad Javad Zarif stating "We don’t have a preference in your election [the United States] to intervene in that election," and "We don’t interfere in the internal affairs of another country," in an interview  on NBC's "Meet The Press". Cybersecurity experts at Microsoft and third-party firms such as ClearSky Cyber Security maintain that Iran, specifically Charming Kitten, was behind the attempted interference, however. In October of 2019, ClearSky released a report supporting Microsoft's initial conclusion. In the report, details about the cyberattack were compared to those of previous attacks known to originate from Charming Kitten. The following similarities were found: