Iranian Espionage Campaign UNK_SmudgedSerpent Targets Academics

• •UNK_SmudgedSerpent targets academics and policy experts with phishing attacks.
• •The campaign uses impersonation tactics and benign initial communications.
• •Attribution is complicated due to similarities with known Iranian threat actors.

Proofpoint has identified an Iranian-linked espionage group named UNK_SmudgedSerpent, which has been active since mid-2025. This group targets academics and foreign policy experts, utilizing highly targeted phishing techniques and credential theft operations. The campaign began with benign emails discussing Iran's internal politics, impersonating credible figures to establish trust before redirecting victims to malicious sites for credential harvesting. The group's tactics resemble those of known Iranian state-aligned actors, including TA453, TA455, and TA450, but with unique variations that complicate attribution. The phishing campaigns have focused on topical issues like Iran's domestic unrest and foreign policy activities. The operational style includes the use of spoofed login portals and Remote Monitoring & Management tools for persistence and lateral movement. As of now, the campaign continues to evolve, indicating a sophisticated approach to social engineering.