{
  "type": "bundle",
  "id": "bundle--7eb39b43-e58e-5695-867b-3a4fd6b78136",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--14343759-cd62-57ff-965c-387fd2ed84ba",
      "name": "Charming Kitten",
      "aliases": [
        "Charming Kitten",
        "Newscaster",
        "Parastoo",
        "iKittens",
        "Group 83",
        "NewsBeef",
        "CharmingCypress",
        "Mint Sandstorm"
      ],
      "description": "Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "skopnix",
          "external_id": "charming-kitten",
          "url": "https://skopnix.com/actors/charming-kitten"
        },
        {
          "source_name": "en.wikipedia.org",
          "url": "https://en.wikipedia.org/wiki/Operation_Newscaster"
        },
        {
          "source_name": "iranthreats.github.io",
          "url": "https://iranthreats.github.io/resources/macdownloader-macos-malware/"
        },
        {
          "source_name": "paper.seebug.org",
          "url": "https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.05.28.NewsCaster_An_Iranian_Threat_Within_Social_Networks/file-2581720763-pdf.pdf"
        },
        {
          "source_name": "forbes.com",
          "url": "https://www.forbes.com/sites/thomasbrewster/2017/07/27/iran-hackers-oilrig-use-fake-personas-on-facebook-linkedin-for-cyberespionage/"
        },
        {
          "source_name": "cryptome.org",
          "url": "https://cryptome.org/2012/11/parastoo-hacks-iaea.htm"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/blog/software/74503/freezer-paper-around-free-meat/"
        },
        {
          "source_name": "verfassungsschutz.de",
          "url": "https://www.verfassungsschutz.de/download/broschuere-2016-10-bfv-cyber-brief-2016-04.pdf"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/newscaster"
        },
        {
          "source_name": "washingtontimes.com",
          "url": "https://www.washingtontimes.com/news/2014/may/29/iranian-hackers-sucker-punch-us-defense-heads-crea/"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/freezer-paper-around-free-meat/74503/"
        },
        {
          "source_name": "scmagazine.com",
          "url": "https://www.scmagazine.com/home/security-news/cybercrime/hbo-breach-accomplished-with-hard-work-by-hacker-poor-security-practices-by-victim/"
        },
        {
          "source_name": "arabnews.com",
          "url": "http://www.arabnews.com/node/1195681/media"
        },
        {
          "source_name": "cyware.com",
          "url": "https://cyware.com/news/iranian-apt-charming-kitten-impersonates-clearsky-the-security-firm-that-uncovered-its-campaigns-7fea0b4f"
        },
        {
          "source_name": "blog.certfa.com",
          "url": "https://blog.certfa.com/posts/the-return-of-the-charming-kitten/"
        },
        {
          "source_name": "justice.gov",
          "url": "https://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber"
        },
        {
          "source_name": "blogs.microsoft.com",
          "url": "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/"
        },
        {
          "source_name": "clearskysec.com",
          "url": "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0058/"
        },
        {
          "source_name": "go.crowdstrike.com",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
        },
        {
          "source_name": "volexity.com",
          "url": "https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/"
        }
      ]
    }
  ]
}