Phosphorus

Threat Actor updated 23 days ago (2024-11-29T14:34:38.406Z)

Download STIX

Preview STIX

Phosphorus, also known as APT35 or Charming Kitten, is a prominent threat actor linked to the Islamic Revolutionary Guard Corps (IRGC) of Iran. The group is notorious for its cyberespionage activities and has been actively targeting high-profile individuals involved in Middle Eastern affairs at universities and research organizations across Belgium, France, Gaza, Israel, the United Kingdom, and the United States since November 2023. Phosphorus employs sophisticated tactics such as custom-tailored phishing emails sent via previously compromised accounts, making their attacks difficult to detect. The Cybereason Nocturnus Team recently discovered a novel PowerShell backdoor related to the Phosphorus group, named PowerLess Backdoor. This previously undocumented tool has been incorporated into Phosphorus' arsenal and used in recent attacks. Phosphorus continually develops and refines its tools, demonstrating its ongoing threat to cybersecurity worldwide. In addition to its malicious activities, Phosphorus is also the name of an IoT security startup which has raised $27M for research and development. The firm, led by CISO John Terrill and security strategist John Vecchi, is focused on mitigating IoT vulnerabilities, particularly out-of-date firmware and default credentials. Phosphorus Security's experts have voiced concerns about resource allocation challenges and cultural differences across various agencies, emphasizing the need for effective and collaborative operational cybersecurity.

Description last updated: 2024-10-02T00:15:32.615Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
APT35 is a possible alias for Phosphorus. APT35, also known as the Newscaster Team, Charming Kitten, and Mint Sandstorm, is an Iranian government-sponsored cyber espionage team. This threat actor conducts long-term, resource-intensive operations to collect strategic and tactical intelligence on behalf of the Islamic Revolutionary Guard Corp	5
Charming Kitten is a possible alias for Phosphorus. Charming Kitten, also known as APT35 or APT42 among other names, is a threat actor believed to be linked to the Iranian government. The group has been implicated in a series of cyber-attacks against various entities in Brazil, Israel, and the U.A.E., deploying a new backdoor that initiates an infect	5
Mint Sandstorm is a possible alias for Phosphorus. Mint Sandstorm, an Advanced Persistent Threat (APT) group linked to Iran's Islamic Revolutionary Guard Corps (IRGC), has been identified as a significant cybersecurity threat. The group has demonstrated its capability to rapidly weaponize N-day vulnerabilities in common enterprise applications and c	4
TA453 is a possible alias for Phosphorus. TA453, also known as Charming Kitten, APT35, Phosphorus, Newscaster, and Ajax Security Team, is a threat actor group suspected to be linked with the Iranian government. Researchers from Proofpoint have attributed cyberattacks on affiliates of former National Security Adviser John Bolton and nuclear	4
Apt42 is a possible alias for Phosphorus. APT42, also known as Charming Kitten, CharmingCypress, Storm-2035, Damselfly, Mint Sandstorm, TA453, and Yellow Garuda, is an Iran-nexus advanced persistent threat (APT) group that has been active in various cyberattacks. The group employs a range of tactics, techniques, and procedures (TTPs), such	3
Ballistic Bobcat is a possible alias for Phosphorus. Ballistic Bobcat, also known as APT35, APT42, Charming Kitten, TA453, and Phosphorus, is a threat actor group believed to be aligned with Iran. The group has been active for several years, developing and deploying a series of backdoor exploits known as Sponsor (versions v1 through v4). Ballistic Bob	3
Newscaster is a possible alias for Phosphorus. APT35, also known as Newscaster Team, is an Iranian government-sponsored cyber espionage group that conducts extensive operations to gather strategic intelligence. The group, which has been active since at least 2014, has been linked to a series of advanced persistent threat (APT) campaigns targetin	2
Mango Sandstorm is a possible alias for Phosphorus. Mango Sandstorm, also known as MuddyWater or Mercury, is a threat actor group linked to Iran's Ministry of Intelligence and Security (MOIS) by the Israeli government. The group has been identified as being involved in several cyber-attacks, utilizing various tactics to gain initial access to targete	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Apt

Phishing

Iran

Ransomware

Malware

Implant

Espionage

Microsoft

Payload

Backdoor

flaw

State Sponso...

Vulnerability

CISA

Papercut

iranian

Microsoft’s

Proxy

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The PowerLess Malware is associated with Phosphorus. Powerless is a malicious software (malware) that was deployed by Ballistic Bobcat in September 2021, during the wrap-up of the campaign documented in CISA Alert AA21-321A. This malware was introduced as part of the PowerLess campaign, which involved the use of a new command and control (C&C) server.	Unspecified	6

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The MERCURY Threat Actor is associated with Phosphorus. Mercury, also known as MuddyWater and Static Kitten, is a threat actor group linked to global espionage activities, with suspected ties to the Iranian Ministry of Intelligence and Security. This group has been noted for its malicious activities, compromising multiple victims that another group, POLO	Unspecified	2
The MuddyWater Threat Actor is associated with Phosphorus. MuddyWater is an Advanced Persistent Threat (APT) actor that first surfaced in 2017, primarily targeting countries in the Middle East, Europe, and the USA. The group uses a range of techniques for its cyber-espionage activities, including PowerShell for execution, HTTP for C2 communications, and mal	Unspecified	2

Associated Vulnerabilities

To see the evidence that has resulted in these vulnerability associations, create a free account

Alias Description	Association Type	Votes
The CVE-2023-27350 Vulnerability is associated with Phosphorus. CVE-2023-27350 represents a significant software vulnerability in PaperCut MF/NG, identified as an improper access control flaw. This weakness allows attackers to bypass authentication processes, providing them with the ability to execute code with system privileges. The vulnerability was first upda	Unspecified	2

Source Document References

Information about the Phosphorus Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
DARKReading	19 hours ago	TP-Link Router Ban Is Mostly About Politics
BankInfoSecurity	3 months ago	Experts Warn CISA’s Threat Sharing is in a 'Death Spiral'
DARKReading	3 months ago	CISA Plan Aligns Cybersecurity Across Federal Agencies
DARKReading	3 months ago	Concerns Over Supply Chain Attacks on US Seaports Grow
BankInfoSecurity	3 months ago	Can CISA’s Federal Cybersecurity Alignment Plan Really Work?
CERT-EU	10 months ago	Rhysida Ransomware Cracked & Decrypted
DARKReading	10 months ago	Islamic Nonprofit Infiltrated for 3 Years With Silent Backdoor
CERT-EU	a year ago	Microsoft: Iranian hackers target researchers with new MediaPl malware
CERT-EU	a year ago	AI looks inward, antitrust bites big tech again and cybersecurity battles intensify \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	a year ago	Nashville-based Phosphorus gets $27M to build out its xIoT security solutions
MITRE	a year ago	Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021 \| Microsoft Security Blog
CERT-EU	a year ago	Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d
CERT-EU	a year ago	Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d \| CISA
CERT-EU	a year ago	Why cyberspace remains largely unaffected amidst ongoing geopolitical turmoil
CERT-EU	a year ago	Weaponizing Wheat: How Strategic Competition With Russia Could Threaten American Food Security – Analysis
CERT-EU	a year ago	Thousands of devices exposed to critical Cisco IOS XE software bug
CERT-EU	a year ago	The Brief – Living online in wartime
CERT-EU	a year ago	Israel Hamas war: Netanyahu warns Israel will ‘demolish Hamas' as thousands flee Gaza
CERT-EU	a year ago	SecurityWeek to Host 2023 ICS Cybersecurity Conference October 23-26 in Atlanta
CERT-EU	a year ago	RagnarLocker Ransomware, LokiLocker Ransomware, and More: Hacker’s Playbook Threat Coverage Round-up: September 27th, 2023