Nation-stateEspionageATT&CK G0059

APT35 (Charming Kitten)

Also known as: Magic Hound, Charming Kitten, Mint Sandstorm, Phosphorus, TA453, COBALT ILLUSION

MITRE tracks APT35 and Charming Kitten under one entry, Magic Hound. The group is known for elaborate, patient social engineering: fake personas, fake conference invitations and credential-phishing pages tailored to each target. Microsoft also reported a subgroup adopting public proof-of-concept exploits shortly after release, and directly targeting US critical infrastructure from late 2021 to mid-2022.

Public attribution: Assessed by MITRE ATT&CK as Iranian-sponsored, likely working for the Islamic Revolutionary Guard Corps (IRGC); Microsoft associates the overlapping Mint Sandstorm with an IRGC intelligence arm.
Active since: Around 2014
Targets: Government and military personnel in the US, Europe and the Middle East
Academics, journalists and policy researchers
US critical infrastructure (a subgroup, 2021-2022)

Notable campaigns

2014 onwardPersona-driven credential phishing
Long-running social engineering against government staff, academics and journalists, including the World Health Organization (MITRE ATT&CK).
2023Mint Sandstorm tradecraft report
Microsoft described the group refining its tradecraft and rapidly exploiting public-facing applications.

Signature ATT&CK techniques

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

Use phishing-resistant MFA, especially for high-profile staff and personal accounts used for work.
Verify new contacts and invitations through independent channels before clicking links or sharing documents.
Patch internet-facing applications as soon as proof-of-concept exploits are published.
Monitor mailboxes for new forwarding rules and unfamiliar sign-ins.

Learn and practise on CyberCertPrep

Haxplain: phishing Glossary: spear phishing OSINT lab

Sources

Notable campaigns

2014 onwardPersona-driven credential phishing

Long-running social engineering against government staff, academics and journalists, including the World Health Organization (MITRE ATT&CK).

2023Mint Sandstorm tradecraft report

Microsoft described the group refining its tradecraft and rapidly exploiting public-facing applications.

Defences that work against this actor

Use phishing-resistant MFA, especially for high-profile staff and personal accounts used for work.

Verify new contacts and invitations through independent channels before clicking links or sharing documents.

Patch internet-facing applications as soon as proof-of-concept exploits are published.

Monitor mailboxes for new forwarding rules and unfamiliar sign-ins.