TA453

TA453, also known as Charming Kitten, APT35, APT42, Ballistic Bobcat, Phosphorus, and Ajax Security Team, is a threat actor linked to the Iranian government. This group has been implicated in numerous cyber espionage activities targeting various entities globally. In one notable incident, researchers at cybersecurity firm Proofpoint attributed a cyberattack on an affiliate of former National Security Adviser John Bolton to TA453. The group has been observed conducting attacks in countries such as Brazil, Israel, and the United Arab Emirates. Furthermore, ESET researchers noted that the activities of this group overlapped with those of other groups like APT35, APT42, and Charming Kitten. The modus operandi of TA453 includes phishing campaigns, deployment of novel malware, and exploitation of unpatched systems. For instance, Proofpoint discovered TA453 engaging in a phishing campaign aimed at nuclear weapons experts. In another campaign, they targeted Macintosh computers with malware-loaded attachments upon receiving responses from victims. They also used sophisticated tactics to maintain secrecy along their attack paths, including deploying modular PowerShell backdoors at the end of their infection chains. Recently, TA453 executed a phishing attack against an Israeli rabbi, demonstrating the group's ongoing malicious activities. In 2020 and 2021, X-Force published details of operations by ITG18 (which overlaps with Charming Kitten, Phosphorous, and TA453) exploiting identities. Moreover, TA453 was observed deploying a previously unknown backdoor malware named 'Sponsor' against 34 companies in Brazil, Israel, and the UAE. These incidents underscore the persistent threat posed by TA453 and the importance of maintaining robust cybersecurity measures to counter their activities.