Charming Kitten
Also known as Newscaster, Parastoo, iKittens, Group 83, NewsBeef, G0058, CharmingCypress, Mint Sandstorm
2mentions, 7 days
2mentions, 30 days
Oct 31, 2026last mentioned
Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors.
Targets: Government, Military, U.S. government/defense sector websites, Saudi Arabia, Israel, Iraq, United Kingdom
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- Charming Kitten APT Adversary Simulation https:// infosec.pub/post/54309761 [ https:// infosec.pub/u/digicat ] # blueteamsecmastodon · Oct 31, 2026
- Charming Kitten APT Adversary Simulationreddit · Oct 31, 2026
References
- https://en.wikipedia.org/wiki/Operation_Newscaster
- https://iranthreats.github.io/resources/macdownloader-macos-malware/
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.05.28.NewsCaster_An_Iranian_Threat_Within_Social_Networks/file-2581720763-pdf.pdf
- https://www.forbes.com/sites/thomasbrewster/2017/07/27/iran-hackers-oilrig-use-fake-personas-on-facebook-linkedin-for-cyberespionage/
- https://cryptome.org/2012/11/parastoo-hacks-iaea.htm
- https://securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf
- https://securelist.com/blog/software/74503/freezer-paper-around-free-meat/
- https://www.verfassungsschutz.de/download/broschuere-2016-10-bfv-cyber-brief-2016-04.pdf
- https://www.cfr.org/interactive/cyber-operations/newscaster
- https://www.washingtontimes.com/news/2014/may/29/iranian-hackers-sucker-punch-us-defense-heads-crea/
- https://securelist.com/freezer-paper-around-free-meat/74503/
- https://www.scmagazine.com/home/security-news/cybercrime/hbo-breach-accomplished-with-hard-work-by-hacker-poor-security-practices-by-victim/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.