HOMETHREATSCharming Kitten
APT / THREAT GROUP🕵️ ESPIONAGE

Charming Kitten

🇮🇷Iran-attributed
9
aliases
Last seen:May 20, 2026

Intelligence Profile

Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors.

Threat Analysis

Charming Kitten is a known-sophistication threat actor attributed to Iran, engaged in cyber operations with a primary motivation of espionage.

The group's espionage-oriented operations suggest a state-sponsored or state-aligned mandate, typically focused on stealing intellectual property, government secrets, or military intelligence. Targets are usually selected for strategic value rather than financial gain.

External References

→https://en.wikipedia.org/wiki/Operation_Newscaster
→https://iranthreats.github.io/resources/macdownloader-macos-malware/
→https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.05.28.NewsCaster_An_Iranian_Threat_Within_Social_Networks/file-2581720763-pdf.pdf
→https://www.forbes.com/sites/thomasbrewster/2017/07/27/iran-hackers-oilrig-use-fake-personas-on-facebook-linkedin-for-cyberespionage/
→https://cryptome.org/2012/11/parastoo-hacks-iaea.htm
→https://securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf
→https://securelist.com/blog/software/74503/freezer-paper-around-free-meat/
→https://www.verfassungsschutz.de/download/broschuere-2016-10-bfv-cyber-brief-2016-04.pdf
→https://www.cfr.org/interactive/cyber-operations/newscaster
→https://www.washingtontimes.com/news/2014/may/29/iranian-hackers-sucker-punch-us-defense-heads-crea/

Quick Facts

TypeAPT / Threat Group
Motivation🕵️ espionage
Origin🇮🇷 Iran
Aliases9
SourceMalpedia

Also Known As

NewsBeefNewscasterCharming KitteniKittensParastooCharmingCypressGroup 83Mint SandstormG0058

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Charming Kitten