{ "id": "be9bd952-94e7-4af9-922a-4070878d5310", "created_at": "2026-04-06T01:31:48.149971Z", "updated_at": "2026-04-10T13:12:15.41022Z", "deleted_at": null, "sha1_hash": "e4e914ba57dad17afb4d57e27149b9b561a58c37", "title": "Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 52831, "plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-06 01:07:33 UTC\r\n APT group: GreenCharlie\r\nNames GreenCharlie (Recorded Future)\r\nCountry Iran\r\nSponsor State-sponsored, Islamic Revolutionary Guard Corps (IRGC)\r\nMotivation Information theft and espionage\r\nFirst seen 2020\r\nDescription\r\n(Recorded Future) In August 2024, open sources revealed that US political campaign officials\r\nand affiliates were targeted as part of Mint Sandstorm and APT 42 operations. In this report,\r\nwe discuss threat activity associated with the Iran-nexus group we track as GreenCharlie,\r\nwhich overlaps with Magic Hound, APT 35, Cobalt Illusion, Charming Kitten. Recorded\r\nFuture has tracked Iran-linked GreenCharlie activity and malicious infrastructure since 2020.\r\nOur global Network Intelligence capability has allowed us to identify and track a large and\r\nrapidly evolving cluster of infrastructure used to support GreenCharlie cyber-espionage\r\ncampaigns. Now, we have been able to link this network to the recent targeting of US political\r\ncampaigns.\r\nObserved Countries: USA.\r\nTools used GORBLE, NOKNOK, POWERSTAR, TAMECAT.\r\nInformation \u003chttps://go.recordedfuture.com/hubfs/reports/cta-ir-2024-0820.pdf\u003e\r\nLast change to this card: 23 October 2024\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2af4b14c-a108-4e9c-a87a-11c6b77de3df\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=2af4b14c-a108-4e9c-a87a-11c6b77de3df\r\nPage 1 of 1", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2af4b14c-a108-4e9c-a87a-11c6b77de3df" ], "report_names": [ "showcard.cgi?u=2af4b14c-a108-4e9c-a87a-11c6b77de3df" ], "threat_actors": [ { "id": "82b92285-4588-48c9-8578-bb39f903cf62", "created_at": "2022-10-25T15:50:23.850506Z", "updated_at": "2026-04-10T02:00:05.418577Z", "deleted_at": null, "main_name": "Charming Kitten", "aliases": [ "Charming Kitten" ], "source_name": "MITRE:Charming Kitten", "tools": [ "DownPaper" ], "source_id": "MITRE", "reports": null }, { "id": "d8af157e-741b-4933-bb4a-b78490951d97", "created_at": "2023-01-06T13:46:38.748929Z", "updated_at": "2026-04-10T02:00:03.087356Z", "deleted_at": null, "main_name": "APT35", "aliases": [ "COBALT MIRAGE", "Agent Serpens", "Newscaster Team", "Magic Hound", "G0059", "Phosphorus", "Mint Sandstorm", "TunnelVision" ], "source_name": "MISPGALAXY:APT35", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "9f778366-a4a7-42f1-ab1e-362aa065ee4f", "created_at": "2022-10-25T16:07:23.362157Z", "updated_at": "2026-04-10T02:00:04.562925Z", "deleted_at": null, "main_name": "APT 42", "aliases": [ "GreenBravo" ], "source_name": "ETDA:APT 42", "tools": [ "BROKEYOLK", "CHAIRSMACK", "CORRUPT KITTEN", "DOSTEALER", "GORBLE", "Ghambar", "MAGICDROP", "PINEFLOWER", "POWERPOST", "SILENTUPLOADER", "TABBYCAT", "TAMECAT", "VBREVSHELL", "VINETHORN" ], "source_id": "ETDA", "reports": null }, { "id": "029625d2-9734-44f9-9e10-b894b4f57f08", "created_at": "2023-01-06T13:46:38.364105Z", "updated_at": "2026-04-10T02:00:02.944092Z", "deleted_at": null, "main_name": "Charming Kitten", "aliases": [ "iKittens", "Group 83", "NewsBeef", "G0058", "CharmingCypress", "Mint Sandstorm", "Parastoo" ], "source_name": "MISPGALAXY:Charming Kitten", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "e3676dfe-3d40-4b3a-bfbd-4fc1f8c896f4", "created_at": "2022-10-25T15:50:23.808974Z", "updated_at": "2026-04-10T02:00:05.291959Z", "deleted_at": null, "main_name": "Magic Hound", "aliases": [ "Magic Hound", "TA453", "COBALT ILLUSION", "Charming Kitten", "ITG18", "Phosphorus", "APT35", "Mint Sandstorm" ], "source_name": "MITRE:Magic Hound", "tools": [ "Impacket", "CharmPower", "FRP", "Mimikatz", "Systeminfo", "ipconfig", "netsh", "PowerLess", "Pupy", "DownPaper", "PsExec" ], "source_id": "MITRE", "reports": null }, { "id": "99c7aace-96b1-445b-87e7-d8bdd01d5e03", "created_at": "2025-08-07T02:03:24.746965Z", "updated_at": "2026-04-10T02:00:03.640335Z", "deleted_at": null, "main_name": "COBALT ILLUSION", "aliases": [ "APT35 ", "APT42 ", "Agent Serpens Palo Alto", "Charming Kitten ", "CharmingCypress ", "Educated Manticore Checkpoint", "ITG18 ", "Magic Hound ", "Mint Sandstorm sub-group ", "NewsBeef ", "Newscaster ", "PHOSPHORUS sub-group ", "TA453 ", "UNC788 ", "Yellow Garuda " ], "source_name": "Secureworks:COBALT ILLUSION", "tools": [ "Browser Exploitation Framework (BeEF)", "MagicHound Toolset", "PupyRAT" ], "source_id": "Secureworks", "reports": null }, { "id": "51258c82-52c1-4a82-b5f6-105f8e0cac57", "created_at": "2024-10-25T02:02:07.722918Z", "updated_at": "2026-04-10T02:00:04.713878Z", "deleted_at": null, "main_name": "GreenCharlie", "aliases": [], "source_name": "ETDA:GreenCharlie", "tools": [ "CharmPower", "GORBLE", "GorjolEcho", "NOKNOK", "POWERSTAR", "TAMECAT" ], "source_id": "ETDA", "reports": null }, { "id": "1699fb41-b83f-42ff-a6ec-984ae4a1031f", "created_at": "2022-10-25T16:07:23.83826Z", "updated_at": "2026-04-10T02:00:04.761303Z", "deleted_at": null, "main_name": "Magic Hound", "aliases": [ "APT 35", "Agent Serpens", "Ballistic Bobcat", "Charming Kitten", "CharmingCypress", "Cobalt Illusion", "Cobalt Mirage", "Educated Manticore", "G0058", "G0059", "Magic Hound", "Mint Sandstorm", "Operation BadBlood", "Operation Sponsoring Access", "Operation SpoofedScholars", "Operation Thamar Reservoir", "Phosphorus", "TA453", "TEMP.Beanie", "Tarh Andishan", "Timberworm", "TunnelVision", "UNC788", "Yellow Garuda" ], "source_name": "ETDA:Magic Hound", "tools": [ "7-Zip", "AnvilEcho", "BASICSTAR", "CORRUPT KITTEN", "CWoolger", "CharmPower", "ChromeHistoryView", "CommandCam", "DistTrack", "DownPaper", "FRP", "Fast Reverse Proxy", "FireMalv", "Ghambar", "GoProxy", "GorjolEcho", "HYPERSCRAPE", "Havij", "MPK", "MPKBot", "Matryoshka", "Matryoshka RAT", "MediaPl", "Mimikatz", "MischiefTut", "NETWoolger", "NOKNOK", "PINEFLOWER", "POWERSTAR", "PowerLess Backdoor", "PsList", "Pupy", "PupyRAT", "SNAILPROXY", "Shamoon", "TDTESS", "WinRAR", "WoolenLogger", "Woolger", "pupy", "sqlmap" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775439108, "ts_updated_at": 1775826735, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/e4e914ba57dad17afb4d57e27149b9b561a58c37.pdf", "text": "https://archive.orkl.eu/e4e914ba57dad17afb4d57e27149b9b561a58c37.txt", "img": "https://archive.orkl.eu/e4e914ba57dad17afb4d57e27149b9b561a58c37.jpg" } }