TA453

TA453, also known as Charming Kitten, APT35, Phosphorus, Newscaster, and Ajax Security Team, is a threat actor group suspected to be linked with the Iranian government. Researchers from Proofpoint have attributed cyberattacks on affiliates of former National Security Adviser John Bolton and nuclear weapons experts to TA453. The group has also been observed targeting entities in Brazil, Israel, and the United Arab Emirates. It's worth noting that TA453's activities overlap with those reported on other groups such as APT35, APT42, Charming Kitten, and Mint Sandstorm. In their most recent campaign, TA453 targeted Macintosh computers using a sophisticated phishing attack involving a PowerShell-based malware toolkit named "BlackSmith." The attackers impersonated the Institute for the Study of War (ISW) and invited victims to a fake podcast via spoofed emails. The malware was delivered through a malicious GoogleDrive link. This BlackSmith malware represents an evolution of previous TA453 toolsets, merging various functions into a single script called "AnvilEcho," which performs tasks like network communication, data encryption, and reconnaissance while evading antivirus software detection. Proofpoint analysts suggest that while direct links between TA453 and individual members of the Islamic Revolutionary Guard Corps (IRGC) are not evident, the group likely operates in support of the IRGC Intelligence Organization (IRGC-IO). This assessment is based on overlaps in unit numbering between Charming Kitten reports and IRGC units. TA453’s campaigns underscore its continued focus on espionage and intelligence gathering, likely in support of the Iranian government. As part of their social engineering techniques, TA453 often poses as reputable individuals or organizations to gain the trust of their targets before deploying their malware.