Summary:
Charming Kitten, also known as Charming Cypress or APT42, is an Iran-backed group notorious for its sophisticated social engineering tactics, primarily targeting policy experts in the Middle East, Europe, and the US. Recently, they employed a fake webinar platform to ensnare their targets, particularly focusing on Middle East policy experts. Masquerading as officials from the International Institute of Iranian Studies (IIIS), they invited policy experts to participate in the webinar, using it as a guise to lure their targets into interacting with malicious content.

Their modus operandi involves tricking victims into installing Trojan-rigged VPN applications, leading to the installation of malware. In September and October 2023, Charming Cypress utilized typo-squatted domains to pose as IIIS officials, demonstrating a low-and-slow approach in their initial email communications to build rapport with targets. Despite their extensive efforts, Charming Kitten's attacks have been flagged by incident response services, such as Volexity.

Security Officer Comments:
The attacks target Middle East policy experts worldwide, with a majority of attacks encountered by Volexity targeting European and US professionals. Charming Kitten's sophisticated social engineering tactics involve setting up entire email chains or phishing scenarios to build rapport with targets. Additionally, their malware arsenal includes the PowerLess backdoor installed by the Windows version of the malware-laden VPN application, leveraging PowerShell to facilitate file transfers, execution, keystroke logging, and screenshot capture.

Suggested Corrections: