Charming Cypress: Innovating Persistence
Summary: Volexity reports that the Iranian-origin threat actor CharmingCypress (aka Charming Kitten, APT42, TA453) ran spear-phishing campaigns through 2023 and into early 2024, including a fake webinar platform that required targets to install malware-laden VPN applications before granting access. In a September-October 2023 campaign impersonating the Rasanah International Institute for Iranian Studies, the actor used typo-squatted domains and delivered POWERLESS to Windows victims and NOKNOK to macOS victims, while a separate RAR-and-LNK chain delivered the previously undocumented BASICSTAR backdoor.
Bottom line: Volexity cracked 16 sets of credentials embedded in the malicious VPN client and tied them to 16 individuals it assesses with high confidence were targets, all experts in Middle East policy - a reminder that a convincing lure and a working VPN can carry malware past users who have every reason to be careful.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026