Loading story…
Check Point Research reported that the Rampant Kitten espionage campaign targeted Iranian expats, dissidents, minorities, and anti-regime organizations in a long-running intelligence-gathering operation attributed to Iran-linked actors. The activity focused on collecting sensitive victim data, including Telegram Desktop files, KeePass password data, documents, and SMS-based two-factor authentication codes, indicating a strong emphasis on surveillance of perceived opponents of the Iranian regime.
Researchers tied the operation to multiple malware families and infrastructure clusters active since 2014, including TelB, TelAndExt, a Python infostealer, and HookInjEx. The attackers used several delivery methods across platforms, including malicious documents, fake software downloads, phishing pages impersonating Telegram, Windows infostealers, and an Android backdoor, showing a sustained and multi-vector effort to compromise targets and exfiltrate communications and credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers observed the TelB variant active from June 2020 to July 2020. This Delphi 64-bit infostealer focused on Telegram Desktop theft and used SOAP-based communications with attacker-controlled domains.
The TelAndExt variant began operating in May 2019 as a Delphi 32-bit Telegram-focused infostealer. It used FTP for command-and-control or exfiltration and was linked to the same campaign infrastructure.
A Python-based infostealer tied to the campaign was active from February 2018 to January 2020. It targeted data from Telegram, Chrome, Firefox, Edge, and Paltalk NG.
Researchers identified the HookInjEx variant as part of the same actor cluster, with activity beginning in December 2014. This malware stole browser data, audio, keystrokes, clipboard contents, and later Telegram Desktop data, using FTP for exfiltration.
Check Point Research published findings on a long-running surveillance operation attributed to Iranian-linked actors targeting Iranian expats, dissidents, minorities, and anti-regime organizations. The report linked multiple malware families, Android spyware, and Telegram phishing infrastructure used for intelligence collection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026
The FBI warned that cyber actors working on behalf of Iran’s **Ministry of Intelligence and Security (MOIS)** used Telegram as command-and-control infrastructure in a long-running malware campaign targeting Iranian dissidents, anti-regime journalists, and other opposition figures around the world. In FLASH-20260320-001, the bureau said the activity has been ongoing since at least fall 2023 and relied on social engineering and victim-tailored lures to deliver multi-stage Windows malware disguised as legitimate applications including **Telegram**, **KeePass**, **WhatsApp**, and **Pictory**. According to the alert, the second-stage implant enabled persistent remote access and bidirectional communications through Telegram infrastructure, allowing operators to steal files, compressed archives, screen captures, and audio from infected systems. The FBI also linked some July 2025 hack-and-leak activity claimed by **Handala Hack** to malware used in the campaign and assessed that Handala Hack is connected to **Homeland Justice**, which it described as another MOIS-operated online entity, underscoring Iran’s broader use of proxy personas and cyber operations to combine espionage, data theft, and information operations.
Jun 29, 2026