Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Charming Kitten · Nation-state · assessed origin Iran · misp-galaxy · refreshed 2026-10-06

Charming Kitten

  • Newscaster
  • Parastoo
  • iKittens
  • Group 83
  • NewsBeef
  • G0058
  • CharmingCypress
  • Mint Sandstorm

state sponsor · Iran (Islamic Republic of)

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE2 new CVEs: CVE-2022-47966, CVE-2022-47986

Analyst brief

misp-galaxy

Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors.

Observed targets (as stated by the sources)

4 countries · 6 sectors
Saudi ArabiaIsraelIraqUnited KingdomAssessed origin: Iran

assessed origin · Iranobserved targets · 4

countries · 4

  • Saudi Arabia
  • Israel
  • Iraq
  • United Kingdom

sectors · 6

  • Government
  • Military
  • Defense
  • Diplomacy
  • Technology
  • Government, Administration

also stated: U.S. government/defense sector websites

as stated by MISP galaxy / ransomware.live — not inferred

CVEs Charming Kitten is cited as exploiting

none on KEV
  1. CVE-2022-479862026-10-17
    1. “They later exploited CVE-2022-47986 in Aspera Faspex within five days of the POC being made public on February 2, 2023.”

      cited as exploiting · named nearby · source: microsoft.com ↗ · 2026-10-17

  2. CVE-2022-479662026-10-17
    1. “For example, Mint Sandstorm began exploiting CVE-2022-47966 in Zoho ManageEngine on January 19, 2023, the same day the POC became public.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2017Charming Kitten: Iranian Cyber Espionage Against Human Rights ActivistsClearsky ↗
  2. 2017Charming Kitten: CSV DataClearsky ↗

Take it with you

keyless · no signup

References

21 sources
  1. 1.en.wikipedia.org/wiki/Operation_Newscaster
  2. 2.iranthreats.github.io/resources/macdownloader-macos-malware
  3. 3.paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.05.28.…
  4. 4.forbes.com/sites/thomasbrewster/2017/07/27/iran-hackers-oilrig-us…
  5. 5.cryptome.org/2012/11/parastoo-hacks-iaea.htm
  6. 6.securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf
  7. 7.securelist.com/blog/software/74503/freezer-paper-around-free-meat
  8. 8.verfassungsschutz.de/download/broschuere-2016-10-bfv-cyber-brief-2016-04.pdf
  9. 9.cfr.org/interactive/cyber-operations/newscaster
  10. 10.washingtontimes.com/news/2014/may/29/iranian-hackers-sucker-punch-us-defen…
  11. +11 more in the JSON record

Track Charming Kitten on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.