Overview 2,410 indicators
Charming Kitten is an Iranian cyber espionage group that has been active since approximately 2014. They appear to focus on targeting individuals of interest to Iran who work in academic research, human rights, and media, with most victims having been located in Iran, the US, Israel, and the UK. [Charming Kitten often tries to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. The group's TTPs overlap extensively with another group, Magic Hound, resulting in reporting that may not distinguish between the two groups' activities.
| domain | 2,262 | G0058-domain.txt |
| ipv4 | 107 | G0058.json |
| url | 25 | G0058.json |
| url_path | 16 | G0058.json |
Principal sources 219 reports
Ranked by how many of this actor's indicators each report brought in.
- 301clearskysec.com/charmingkitten
- 301clearskysec.com/wp-content/uploads/2017/12/Charming_Kit…
- 301virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e04…
- 301virustotal.com/gui/file/971c5b5396ee37827635badea90d26…
- 301virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8…
- 301virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1c…
- 301virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc…
- 301virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7…
Related groups 4
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 2,410 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
300 shown
Showing the 300 most recent of 2,410. Complete: G0058.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
securelist.com/mirage-kitten-new-tools/120811
domain aecert.org domain api.neexportfolio.com domain app.neexportfolio.com domain business-deegital.azurewebsites.net domain business-deegital.com domain businessdeegital.azurewebsites.net domain businesslocked.com domain businessmixture.com domain cards.ohana-village.org domain cld-global.com domain dn.neexportfolio.com domain drhealthyrecommends.com domain global-reds.com domain healthcarezoom-centeral.azurewebsites.net domain healthcarezoomcenteral.azurewebsites.net domain healthcarezoomcenteral.org domain m.neexportfolio.com domain maadinglobal.com domain neexportfolio.azurewebsites.net domain neexportfolio.com domain neexportfolio.eastus.cloudapp.azure.com domain ohana-village.org domain realhealthshop.com domain smartconnect.azurewebsites.net domain thehealth-life.com domain tinyandjudy.com domain tjconsultingservices.com domain toadreport.azurewebsites.net domain tuinpe.shop url_path /edfcvfgbhnjmkqwasderfgg -
x.com/nextronresearch/status/2078037561667142… · nextron-systems.com/2026/06/01/detecting-nimbus-manticore-a…
30min-ergmeeting.com 30min-ergmeeting.net 30min-smartsight-hr.com 30min-smartsight.com 30min-ziprecruiter.com 30min-ziprecruiterhr.com 30minmeeting-quality.com 30minmeetinghr.com 30minziprecruiterhr.net 8475.freelancedeveloper.site anymediaapp.com app.hostedlayer.com bc-app.orgdatasolutions.com booking.microsoftcalendars.com booking.mountainsgate.com booking.virtualdeskflowr.com bookings.hcpassociation.com.au bookmenow.info budgetingscheduler.pages.dev calendar-cn8.pages.dev calendar.fractionalleverage.com collab.vaf.ai crimson-peaks.com cstoddart-meeting-scheduler.firebaseapp.com demo-meeting.captello.com duschedule.ibridgellc.com eand.cyvehx.com eu-meeting.captello.com ez-calendar.vercel.app form.redberyl.co form.ritwiksingh.com geticarefunds.com jafferbrothers.developmint.xyz letsschedulethis.com mail.smart-sight-hr.com meet.13bytes.de meet.dynamicsmind.in meet.fruitcakemedia.co.uk meet.thijsblom.app meet.thijsblom.dev meet.webdeploy.dev meeting-schedular-flame.vercel.app meeting-schedular.aptc.ricoh.com meeting-scheduler-ui.pages.dev meeting-scheduler.cloud meeting-scheduler.co.uk meeting-scheduler.com meeting-scheduler.metal.kaldi.si meeting-scheduler.ncb.org meeting-scheduler.online meeting-scheduler.saetta.co.jp meeting-scheduler.tous33f.live meeting-scheduler.xyz meeting-scheduling.oldcountry.ai meeting-space-scheduler-9946.taskade.app meeting.captello.com meeting.dalqan.com meeting.ignsoftwares.in meeting.jackz.me meeting.wilawan.com meeting.xn--grnlund-b1a.net meetings-demo.apigateway.co meetings-prod.apigateway.co meetings.dialexa.com meetings.fl2f.ca meetings.sabonzy.com meetings.xn--grnlund-b1a.net meetingscheduler.sandbox.aws.corp.cloud5.com meetingscheduler.servehttp.com meetingscheduler.thebeautymatcher.com meets.armankhan.me meets.armankhan.space ms.supermwario.com msp.medatron.co office365calendar.com pages.ultimatecartanddolly.com planner.croes.info planner.houseedge.co.za plans.pravd.in plansdev.pravd.in profivoda.slotig.cz puredcmeeting.com rabot.pisrc.net rwccalendar.rwcsystems.net schedule.gmta.nl scheduler.niced.cloud scheduler.scratchspace.dev scheduler.unionsavings.ca sirc.travyfy.com smart-sight-hr.com staging-meeting.captello.com tb-meet.pages.dev theush.uk threshold.tailba29da.ts.net tymelinx.com ush.team v4automaticreferrals.com virtualphoneassistant.com vote.nikosevag.gr wh1425239.ispot.cc whensy.ru workspaceviewers.com -
unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens · research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-…
codzienniefita.info codzienniefity.info getsqldeveloper.com getsqldeveloper.it.com global-check-business-it.azurewebsites.net global-check-itbusiness.azurewebsites.net global-it-checkbusiness.azurewebsites.net global-it-checkers.azurewebsites.net global-it-consultants.azurewebsites.net globalbusiness-checkers-it.azurewebsites.net globalit-consultants.azurewebsites.net globalitconsultants.azurewebsites.net hb.pee5.me hu.yes1.me ie.codzienniefita.info pee5.me prostozdrowo.info prostozdrowoa.info stylzdrowia.info stylzdrowiaa.info wybieramzdrowie.info wybieramzdrowiea.info yes1.me zdrowaplaneta.info zdrowaplanetaa.info zdrowaplanetab.com zdrowaprzemiana.com zdrowaprzemianaa.com zdrowaprzemianab.com zdrowienapelnym.com zdrowienapelnyma.com zdrowienapelnymb.com zdrowykierunek.com zdrowykieruneka.com zdrowykierunekb.com -
unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens · research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-…
buisness-centeral-transportation.azurewebsites.net buisness-centeral-transportation.com buisness-centeral.azurewebsites.net business-startup.azurewebsites.net business-startup.org businessstartup.azurewebsites.net docspace-twpf0e.onlyoffice.com docspace-y4cumb.onlyoffice.com elementshift.azurewebsites.net licencemanagers.azurewebsites.net licencesupporting.azurewebsites.net nanomatrix.azurewebsites.net peerdistsvcmanagers.azurewebsites.net premier-healthadvisory.azurewebsites.net premierhealthadvisory.azurewebsites.net premierhealthadvisory.com quantumweave.azurewebsites.net ramiltons-finance.azurewebsites.net ramiltonsfinance.azurewebsites.net ramiltonsfinance.com themesmanagers.azurewebsites.net themesprovidermanagers.azurewebsites.net -
x.com/ThreatBookLabs/status/20105402429322694… · virustotal.com/gui/file/e7b2cc236af9edbe44307d293a7d7f… · virustotal.com/gui/file/a6b0c63b2aa25d5fe8ff5b9bd4d286…
baochinhphu.org -
x.com/Cyberteam008/status/1927915406288695626
accounts.google.live-meet.blog accounts.google.live-meet.cfd accounts.google.live-meet.cloud accounts.google.live-meet.info accounts.google.network-show.online actor.rap-art.info albert-company.online all-for-city.info amg-car-ger.info anna-blog.info apple.beta-man.info april.spring-club.info arizonaclub.me arrow-click.info backback.info best85best.online beta-man.info bmw.amg-car-ger.info book.anna-blog.info bvio85.info cc-newton.info chapter1.cc-newton.info cnt-worth.online connect-room.online crysus-h.info data.live-meet.blog dmn-for-car.online exir-juice.online friends.lizza-blog.info friends.thomas-mark.xyz good-student.online goods-companies.online google.live-meet.blog google.live-meet.cfd google.live-meet.cloud google.live-meet.info google.network-show google.network-show.online hrd-dmn.info human-fly900.online intelligence.live-meet.blog ip-194-11-226-29.rockhoster.net isftyviliam.platinum-cnt.info live-coaching.online live-conn.online live-gml.online live-meet.blog live-meet.cfd live-meet.cloud live-meet.info live-meet.live live.connect-room.online live.goods-companies.online live.live-coaching.online live.live-gml.online live.live-meet live.live-meet.cloud live.live-meet.info live.online-room.online live.platinum-cnt.info live.white-life-bl.info live.yamal-group.online lizza-blog.info lynda-tricks.online mail.bvio85.info meet-work.info message-live.online mickel.connect-room.online mickel.goods-companies.online mickel.live-coaching.online mickel.platinum-cnt.info mickel.white-life-bl.info mickel.yamal-group.online mikel.yamal-group.online network-show.online nsim-ph.info ntp-clock-h.info online-room.online oranus.albert-company.online oranus.connect-room.online oranus.human-fly900.online oranus.live-coaching.online oranus.platinum-cnt.info oranus.white-life-bl.info oranus.yamal-group.online outlook.live.live-meet.cloud outlook.live.live-meet.info panel.live-meet.blog panel.live-meet.cfd panel.live-meet.cloud panel.live-meet.info panel.live-meet.live panel.network-show.online pfl.redirect-review.online ph-crtdomain.info platinum-cnt.info prj-ph.info profile.arizonaclub.me profile.best85best.online prt-max.online rap-art.info rbconline-support.info redirect-review.online richard-3th.online right.arrow-click.info rockhoster.net roland-cc.online sandbox.live-meet.blog shadow-network.best smtp.amg-car-ger.info · 40 more in this batch, in the JSON
Further reading 221
- clearskysec.com/wp-content/uploads/2017/12/Charming_Kit…
- attack.mitre.org/groups/G0058
- researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-att…
- twitter.com/G60930953/status/1747821766074863690
- go.recordedfuture.com/hubfs/reports/cta-ir-2024-0820.pdf
- virustotal.com/gui/ip-address/144.217.129.176/relations
- x.com/k3yp0d/status/1840762048826728893
- virustotal.com/gui/file/84366a894120d4a8c83411925ef04d…
- virustotal.com/gui/file/4431b2a4d7758907f81fb1a0c1e36b…
- virustotal.com/gui/ip-address/185.182.194.50/relations
- x.com/RecordedFuture/status/18258679260433123…
- virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b…
- virustotal.com/gui/ip-address/38.180.111.244/relations
- virustotal.com/gui/ip-address/78.159.117.177/relations
- shodan.io/host/136.243.108.10
- otx.alienvault.com/pulse/624f0d6039be61f29b5f463c
- virustotal.com/gui/file/c8baf145f2f586167ed108eca143ce…
- twitter.com/k3yp0d/status/1650513653802708996
- github.com/blackorbird/APT_REPORT/blob/master/Char…
- x.com/blackorbird/status/1992075483836744154
- virustotal.com/gui/ip-address/91.214.124.143/relations
- twitter.com/ET_Labs/status/1629278117071147008
- virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1c…
- nextron-systems.com/2026/06/01/detecting-nimbus-manticore-a…
- research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability…
- proofpoint.com/us/blog/threat-insight/badblood-ta453-t…
- twitter.com/IronNetTR/status/1562913027951042561
- virustotal.com/gui/ip-address/144.202.123.86/relations
- virustotal.com/gui/file/e37b95bb9bee64cc0313eaad8a0269…
- clearskysec.com/wp-content/uploads/2019/10/The-Kittens-…
- research.checkpoint.com/2023/educated-manticore-iran-aligned-th…
- x.com/ThreatBookLabs/status/19572762889449186…
- virustotal.com/gui/file/2b9c941150206d38a635620f212966…
- x.com/ValidinLLC/status/1867193831612985822
- virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8…
- virustotal.com/gui/ip-address/91.107.155.179/relations
- mandiant.com/media/17826 (# apt42, crookedcharms)
- github.com/pan-unit42/iocs/blob/master/iran_linked…
- x.com/k3yp0d/status/1852051018181452143
- twitter.com/kyleehmke/status/1339602993814102016
181 more, and the report behind every indicator, in G0058.json.