ThreatCluster

Iranian Cyber Espionage Targets US Academics and Policy Experts

First seen 23 Nov 2025, 03:35 UTC • •35

Article Content

1 / 2

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Between June and August 2025, a previously unidentified Iranian cyber actor, dubbed UNK_SmudgedSerpent, conducted targeted phishing attacks against US academics and foreign policy experts. The campaign aimed to steal credentials and gather intelligence related to Iranian political developments, utilizing techniques common to Iranian state-sponsored cyber activities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (1)

Threat Graph

13 entities, 36 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (5)

Charming Kitten
Mango Sandstorm
MuddyWater
Smoke Sandstorm
UNK_SmudgedSerpent

Technique (2)

Malware
Phishing

Organization (1)

Brookings Institution

Affected Platform (1)

Microsoft 365

Tool (4)

Gmail
Microsoft Teams
OnlyOffice
RMM software

Relationships

Charming Kitten uses Gmail
Charming Kitten uses Microsoft Teams
Charming Kitten uses OnlyOffice
Charming Kitten uses RMM software
Mango Sandstorm uses Gmail
Mango Sandstorm uses Microsoft Teams
Mango Sandstorm uses OnlyOffice
Mango Sandstorm uses RMM software
MuddyWater uses Gmail
MuddyWater uses Microsoft Teams
MuddyWater uses OnlyOffice
MuddyWater uses RMM software
Smoke Sandstorm uses Gmail
Smoke Sandstorm uses Microsoft Teams
Smoke Sandstorm uses OnlyOffice
Smoke Sandstorm uses RMM software
UNK_SmudgedSerpent uses Gmail
UNK_SmudgedSerpent uses Microsoft Teams
UNK_SmudgedSerpent uses OnlyOffice
UNK_SmudgedSerpent uses RMM software
Charming Kitten uses Malware
Charming Kitten uses Phishing
Mango Sandstorm uses Malware
Mango Sandstorm uses Phishing
MuddyWater uses Malware
MuddyWater uses Phishing
Smoke Sandstorm uses Malware
Smoke Sandstorm uses Phishing
UNK_SmudgedSerpent uses Malware
UNK_SmudgedSerpent uses Phishing
Charming Kitten targets Brookings Institution
Mango Sandstorm targets Brookings Institution
MuddyWater targets Brookings Institution
Smoke Sandstorm targets Brookings Institution
UNK_SmudgedSerpent targets Brookings Institution
Charming Kitten related to Microsoft 365

Following this threat?

Track Charming Kitten and Brookings Institution in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…