Iranian Cyber Espionage Targets US Academics and Policy Experts

First seen 23 Nov 2025, 03:35 UTC • Proofpoint

•35

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Between June and August 2025, a previously unidentified Iranian cyber actor, dubbed UNK_SmudgedSerpent, conducted targeted phishing attacks against US academics and foreign policy experts. The campaign aimed to steal credentials and gather intelligence related to Iranian political developments, utilizing techniques common to Iranian state-sponsored cyber activities.

How this analysis works

Attack Flow

13 entities, 36 inferred relationships (STIX 2.1).

Threat Actor (5)

Charming Kitten
Mango Sandstorm
MuddyWater
Smoke Sandstorm
UNK_SmudgedSerpent

Technique (2)

Malware
Phishing

Organization (1)

Brookings Institution

Affected Platform (1)

Microsoft 365

Tool (4)

Gmail
Microsoft Teams
OnlyOffice
RMM software

Relationships

Charming Kitten uses Gmail
Charming Kitten uses Microsoft Teams
Charming Kitten uses OnlyOffice
Charming Kitten uses RMM software
Mango Sandstorm uses Gmail
Mango Sandstorm uses Microsoft Teams
Mango Sandstorm uses OnlyOffice
Mango Sandstorm uses RMM software
MuddyWater uses Gmail
MuddyWater uses Microsoft Teams
MuddyWater uses OnlyOffice
MuddyWater uses RMM software
Smoke Sandstorm uses Gmail
Smoke Sandstorm uses Microsoft Teams
Smoke Sandstorm uses OnlyOffice
Smoke Sandstorm uses RMM software
UNK_SmudgedSerpent uses Gmail
UNK_SmudgedSerpent uses Microsoft Teams
UNK_SmudgedSerpent uses OnlyOffice
UNK_SmudgedSerpent uses RMM software
Charming Kitten uses Malware
Charming Kitten uses Phishing
Mango Sandstorm uses Malware
Mango Sandstorm uses Phishing
MuddyWater uses Malware
MuddyWater uses Phishing
Smoke Sandstorm uses Malware
Smoke Sandstorm uses Phishing
UNK_SmudgedSerpent uses Malware
UNK_SmudgedSerpent uses Phishing
Charming Kitten targets Brookings Institution
Mango Sandstorm targets Brookings Institution
MuddyWater targets Brookings Institution
Smoke Sandstorm targets Brookings Institution
UNK_SmudgedSerpent targets Brookings Institution
Charming Kitten related to Microsoft 365

Continue Reading

Iranian Hackers Target US Aviation with New Malware and SEO Poisoning Surge in Middle East Cyber Espionage Amid Ongoing Conflict North Korea Adopts Modular Malware to Evade Detection and Takedowns New York Implements Cyber Regulations Amid Rising Threats to Water Facilities Iran Cyber Attack Involves APTs and Hacktivist Proxies RedKitten Campaign Targets Iranian Protest Monitors with AI Malware

Iranian Cyber Espionage Targets US Academics and Policy Experts

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading