Threat Actor Profile Charming Kitten

There is no account yet of Charming Kitten being active in the Netherlands. However, Iranian actors have set their sights on the Netherlands in the past, and due to the increasing versatility of Charming Kitten, it is possible that an attack will occur eventually. Iranian actors are nothing new in the Netherlands, as they were responsible for one of the country's most notorious hacks, at DigiNotar. Also, in 2020, PwC published a report saying that Iranian hackers had tried to compromise Dutch universities and colleges, seeking to obtain knowledge to use in their own educational system.

Due to Charming Kitten’s recent step-up in sophistication, and in addition to the change in motivation (retaliation attack in 2023 and targeting critical infrastructure), the group constitutes a realistic threat to organizations in the Netherlands. The General Intelligence & Security Agency (AIVD) has been issuing warnings for years about Iran’s offensive activities in Dutch cyberspace, describing it as one of the biggest digital threats to the Netherlands.

Figure 5 – The Netherlands is the second most used IP address supplier for Charming Kitten’s attacks 

Another angle where the Netherlands shows up when looking into Charming Kitten, is that they often make use of Dutch IPs for their attacks. In an investigation into Indicators of Compromise (IoC) of the threat actor, IP addresses from the Netherlands were featured prominently. After the US, the Netherlands is the second most used country for IP addresses (see Figure 5). A plausible reason for this is the high-quality ICT infrastructure in the Netherlands, which is reliable, stable and accessible.

For years, Charming Kitten was best known for their extensive spear-phishing and social engineering campaigns. With tricks and persistence, they were able to breach the email accounts of their targets. This remains a core component of their approach to breaching targets to this day. However, since 2021 there are a few clear changes in the way the Kittens operate, and the targets they choose. From attacking dissidents and scholars, they have expanded their activities to ransomware attacks and attacking critical infrastructure. This new range of targeting was accompanied by the development of custom tools, such as BELLACIAO and HYPERSCRAPER, and they gained ability to quickly weaponize known vulnerabilities (N-days), sometimes within the first day of going public.  

This trend coincided with a simultaneous decrease in ransomware and wiper attacks from threat actors associated with the IRGC, indicating that after a few forays into financial and sabotage-motivated attacks, Charming Kitten returned to the espionage track. The shift in tactics also aligns with faster adoption of newly reported vulnerabilities, the use of compromised websites for command and control (C2) purposes to obscure the source of attacks, and in some cases, the development of customized tools and advanced techniques. These developments collectively indicate that although Iranian threat groups may not possess the same level of technical sophistication as their Russian and Chinese counterparts, they are improving their ability to gain access to specific targets of interest, maintain persistence, and evade detection.

Their rapid development implies that Charming Kitten is benefiting from the uptick in priority that the IRGC has been receiving from Tehran; the IRGC is pocketing larger portions of Iran’s state budget every year, at the cost of the traditional military. For example, in 2023, the IRGC received 31% of the military budget, compared to the 11% that went to the army. Through these statistics, Tehran’s priorities are becoming clear, especially when considering that the army employs 2.5 times more personnel than the IRGC. With the new funds, the IRGC is able to modernize its operations and equipment. The increasing priority for the IRGC is indicating that Iran is stepping up its irregular warfare capabilities and focusing less on traditional military forces. With the IRGC as its omnipotent tool, Iran hopes to establish regional power, and counter its stronger adversaries globally, like the US.

The advancement of the group is worrying, as their activities become harder to predict. Who knows when they will resort to ransomware again? Or focus all their attention on developing new tools? Over the timeframe 2021-2023, Charming Kitten has shown great versatility in modus operandi, targeting, and motivation. With their expanding activities and their overarching benefactor’s growing funds, the future of the group remains shrouded in mystery.