Iran-aligned #TA453 ( #CharmingKitten #APT42 ) recently attempted credential phishing against a US think tank.
Notably, the email exchange began before the conflict, indicating continued prioritization of longstanding intelligence targets.
#CharmingKitten #APT42 #TA453
Hash:
87144d0aa002a87376b673f7d0c0eb88
C2:
Telegram Bot used for error messages and auto-start messaging to the operator
computerlearning.ddns./net
Pivots:
bookstoragestore./com
lastfilterfile/.info
78.159.117./177
78.159.117./175
185.132.176./241
154.44.186./106
