Loading story…
A previously unidentified threat group, dubbed UNK_SmudgedSerpent, conducted a series of targeted phishing attacks against U.S.-based academics and foreign policy experts between June and August 2025. The campaign coincided with heightened Iran–Israel tensions and leveraged lures related to Iranian domestic politics and the Islamic Revolutionary Guard Corps (IRGC). Attackers impersonated prominent U.S. foreign policy figures, including those from think tanks such as the Brookings Institution and the Washington Institute, to increase the credibility of their phishing attempts. The emails often initiated benign conversations before escalating to credential phishing, sometimes delivering malicious URLs disguised as Microsoft Teams installers that ultimately deployed legitimate Remote Monitoring and Management (RMM) tools like PDQ Connect.
Proofpoint researchers noted that the tactics, techniques, and procedures (TTPs) used by UNK_SmudgedSerpent overlapped with those of established Iranian APTs, including TA453 (Charming Kitten), TA455 (Smoke Sandstorm), and TA450 (MuddyWater), but the precise attribution remains unclear. The group targeted over 20 subject matter experts focused on Iran policy, with some attacks involving additional social engineering steps such as identity verification requests. The campaign highlights the evolving sophistication of Iranian cyber espionage efforts and the persistent targeting of individuals shaping U.S. policy on Iran.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On November 5, 2025, Proofpoint published research on UNK_SmudgedSerpent, describing the campaign and assessing that its tactics and infrastructure overlapped with multiple Iranian-aligned groups including TA453, TA455, and TA450. Because of the mixed indicators, Proofpoint said attribution remained low confidence and kept the activity tracked as a distinct cluster.
Proofpoint reported that it did not observe further email campaign activity from UNK_SmudgedSerpent after early August 2025. The company noted, however, that related operations may have continued beyond the visible email activity.
In at least some cases during the June-August 2025 operation, when credential theft appeared unsuccessful or was suspected, the actor shifted to malware delivery. Victims were sent archives or MSI installers disguised as collaboration software that installed legitimate remote monitoring and management tools including PDQ Connect, followed in some cases by ISL Online for suspected hands-on-keyboard access.
During the campaign, the threat actor impersonated prominent U.S. foreign policy figures and think-tank affiliations in benign-looking email exchanges that evolved into phishing. Victims were sent OnlyOffice, Microsoft Teams, or Microsoft 365-themed links leading to customized credential-harvesting pages for Microsoft accounts.
Between June and August 2025, a previously unidentified threat cluster tracked by Proofpoint as UNK_SmudgedSerpent conducted targeted cyber-espionage activity against U.S. think tanks, academics, and foreign policy experts. The lures focused on Iran-related topics amid heightened Iran–Israel tensions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcedarkreading.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-sponsored threat actor MuddyWater has conducted a large-scale cyberespionage campaign breaching over 100 government entities and international organizations across the Middle East and North Africa. The attackers leveraged a compromised enterprise mailbox, accessed via NordVPN, to send convincing phishing emails from legitimate addresses to embassies, ministries, and telecom providers. These emails contained weaponized Microsoft Word attachments that, when opened and macros enabled, deployed the updated "Phoenix" backdoor, granting persistent remote access, credential theft, and file exfiltration capabilities. The campaign also utilized off-the-shelf remote management tools such as PDQ and Action1 to blend in with legitimate administrative traffic and pilfered browser passwords from Chrome, Edge, Opera, and Brave. Researchers at Group-IB highlighted that MuddyWater, also known as Seedworm, APT34, OilRig, and TA450, has demonstrated evolving tradecraft and operational maturity in this operation, mixing official government and personal email addresses to increase the likelihood of successful compromise. The campaign's scale and targeting suggest either a significant increase in capability or a broader intelligence collection mandate from Iranian authorities. MuddyWater, linked to Iran's Ministry of Intelligence and Security, has a history of targeting government, energy, telecom, and defense sectors, focusing on long-term espionage rather than destructive attacks. Analysts warn that further activity is likely amid ongoing regional tensions.
Jun 29, 2026
Iranian state-sponsored threat actors have intensified their cyber operations, targeting government officials, defense sector personnel, and dissidents through sophisticated espionage and disruptive campaigns. The APT42 group, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), has launched the 'SpearSpecter' campaign, employing highly personalized social engineering tactics to compromise senior defense and government officials, as well as their family members. These operations involve building trust over extended periods and leveraging fake conference invitations or meetings to deliver malicious payloads. Other Iranian-linked groups, such as Ferocious Kitten, have focused on targeting dissidents and activists with spear-phishing attacks that deploy custom malware like MarkiRAT, which features advanced data exfiltration and persistence techniques. In parallel, the DEV-1084 group, operating under the 'DarkBit' persona and closely associated with the Iranian state-linked MERCURY group, has conducted ransomware campaigns that prioritize destruction over financial gain. These attacks combine on-premises encryption with the mass deletion of cloud resources, effectively wiping out victim environments and aligning with broader strategic objectives of disruption and psychological impact. Technical analysis has revealed shared infrastructure and tools between DEV-1084 and MERCURY, further solidifying the connection to Iran’s Ministry of Intelligence and Security (MOIS). These coordinated campaigns underscore the evolving threat landscape posed by Iranian APTs, which blend espionage, destructive attacks, and advanced social engineering to achieve their objectives.
Jul 12, 2026
A joint advisory from the FBI, U.S. Cyber Command Cyber National Mission Force, the U.S. Department of the Treasury, and the UK National Cyber Security Centre says cyber actors working on behalf of Iran’s Islamic Revolutionary Guard Corps are conducting social-engineering and phishing campaigns against personal and business accounts. The activity has targeted people connected to Iranian and Middle Eastern affairs, including current and former senior government officials, think tank personnel, journalists, activists, lobbyists, and more recently individuals associated with U.S. political campaigns. The operators reportedly impersonate trusted contacts, journalists, relatives, or email providers, build rapport over time, and then direct victims to credential-harvesting pages that also capture multi-factor authentication codes. The advisory says successful compromises can lead to suspicious logins, unauthorized email forwarding rules, connections from unknown devices or applications, message theft and deletion, and attempts to pivot into additional accounts. Authorities urged organizations to strengthen phishing awareness, deploy anti-spoofing protections, disable external auto-forwarding where possible, monitor mailbox-rule changes, enable alerts for anomalous logins, and adopt phishing-resistant MFA, including hardware-backed authentication methods. The references provided did not supply usable details tying the second document to this activity, so the reported event is defined by the joint warning on IRGC-linked account targeting.
Jun 29, 2026