{ "Event": { "analysis": "2", "date": "2018-12-17", "extends_uuid": "", "info": "OSINT - The Return of The Charming Kitten", "publish_timestamp": "1545079511", "published": true, "threat_level_id": "3", "timestamp": "1545079498", "uuid": "5c18091d-d158-41aa-88c7-4692950d210f", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#ffffff", "local": "0", "name": "tlp:white", "relationship_type": "" }, { "colour": "#00223b", "local": "0", "name": "osint:source-type=\"blog-post\"", "relationship_type": "" }, { "colour": "#11da00", "local": "0", "name": "misp-galaxy:threat-actor=\"Charming Kitten\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079140", "to_ids": false, "type": "link", "uuid": "5c180964-4e10-4189-aa57-4685950d210f", "value": "https://blog.certfa.com/posts/the-return-of-the-charming-kitten/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079175", "to_ids": false, "type": "text", "uuid": "5c180987-3da0-4715-b69b-498c950d210f", "value": "Phishing attacks are the most common form of infiltration used by Iranian state-backed hackers to gain access into accounts. Certfa reviews the latest campaign of phishing attacks that has been carried out and dubbed as \u00e2\u20ac\u0153The Return of The Charming Kitten\u00e2\u20ac\u009d.\r\n\r\nIn this campaign, hackers have targeted individuals who are involved in economic and military sanctions against the Islamic Republic of Iran as well as politicians, civil and human rights activists and journalists around the world.\r\n\r\nOur review in Certfa demonstrates that the hackers - knowing that their victims use two-step verification - target verification codes and also their email accounts such as Yahoo! and Gmail. As a result, Certfa believes the safest existing way to confront these attacks is using Security Keys such as YubiKey." }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079323", "to_ids": true, "type": "ip-dst", "uuid": "5c180a1b-2ca8-432c-b105-4d0c950d210f", "value": "178.162.132.65" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079325", "to_ids": true, "type": "ip-dst", "uuid": "5c180a1d-c488-45b5-8d5e-4247950d210f", "value": "190.2.154.34" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079326", "to_ids": true, "type": "ip-dst", "uuid": "5c180a1e-13d0-4489-b976-4c0d950d210f", "value": "190.2.154.35" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079327", "to_ids": true, "type": "ip-dst", "uuid": "5c180a1f-d0b8-4823-819e-4bd5950d210f", "value": "190.2.154.36" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079328", "to_ids": true, "type": "ip-dst", "uuid": "5c180a20-8ebc-462e-ae17-4eb3950d210f", "value": "190.2.154.38" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079330", "to_ids": true, "type": "ip-dst", "uuid": "5c180a22-28e4-4fc7-aaa0-4e0a950d210f", "value": "46.166.151.211" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079331", "to_ids": true, "type": "ip-dst", "uuid": "5c180a23-64d4-4f63-9505-4c89950d210f", "value": "51.38.87.64" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079332", "to_ids": true, "type": "ip-dst", "uuid": "5c180a24-8308-4a44-8df0-47ec950d210f", "value": "51.38.87.65" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079334", "to_ids": true, "type": "ip-dst", "uuid": "5c180a26-a904-4be3-9282-4660950d210f", "value": "51.68.185.96" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079335", "to_ids": true, "type": "ip-dst", "uuid": "5c180a27-b4a8-4b09-bd4c-4ec2950d210f", "value": "51.38.107.113" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079335", "to_ids": true, "type": "ip-dst", "uuid": "5c180a27-94a4-4681-99dd-446c950d210f", "value": "95.211.189.45" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079336", "to_ids": true, "type": "ip-dst", "uuid": "5c180a28-3c24-4a25-b1e9-46ce950d210f", "value": "95.211.189.46" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079336", "to_ids": true, "type": "ip-dst", "uuid": "5c180a28-dee0-437f-8024-4e93950d210f", "value": "95.211.189.47" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079337", "to_ids": true, "type": "ip-dst", "uuid": "5c180a29-d948-417a-a429-4617950d210f", "value": "213.227.139.148" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079337", "to_ids": true, "type": "ip-dst", "uuid": "5c180a29-623c-4e02-941c-4b94950d210f", "value": "54.37.241.221" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079337", "to_ids": true, "type": "ip-dst", "uuid": "5c180a29-87c8-4dfd-b299-4683950d210f", "value": "54.38.144.250" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079338", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2a-1514-473e-84bf-48e3950d210f", "value": "54.38.144.251" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079338", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2a-3dfc-4442-aa2c-40d4950d210f", "value": "54.38.144.252" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079339", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2b-c934-4047-9b06-4ddb950d210f", "value": "85.17.127.172" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079339", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2b-615c-4cb4-b783-49b8950d210f", "value": "85.17.127.173" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079340", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2c-5fc0-468f-9a7b-4b3b950d210f", "value": "85.17.127.174" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079340", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2c-5ca4-46a6-942c-4c57950d210f", "value": "85.17.127.175" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079341", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2d-955c-4009-ac98-490f950d210f", "value": "89.198.179.103" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079341", "to_ids": true, "type": "ip-dst", "uuid": "5c180a2d-835c-423b-b744-4caf950d210f", "value": "31.2.213.18" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079342", "to_ids": true, "type": "domain", "uuid": "5c180a2e-71e4-47fe-bcb4-4079950d210f", "value": "accounts-support.services" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079342", "to_ids": true, "type": "domain", "uuid": "5c180a2e-4d94-4a0c-aefe-4447950d210f", "value": "broadcast-news.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079342", "to_ids": true, "type": "domain", "uuid": "5c180a2e-f76c-4bd0-861d-48d0950d210f", "value": "broadcastnews.pro" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079343", "to_ids": true, "type": "domain", "uuid": "5c180a2f-f8a4-4f92-92fa-4cc6950d210f", "value": "com-identifier-servicelog.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079343", "to_ids": true, "type": "domain", "uuid": "5c180a2f-838c-4a83-93a3-42f6950d210f", "value": "com-identifier-servicelog.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079344", "to_ids": true, "type": "domain", "uuid": "5c180a30-7724-44c1-83a3-4df7950d210f", "value": "com-identifier-userservicelog.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079344", "to_ids": true, "type": "domain", "uuid": "5c180a30-8f0c-4a1e-930c-439f950d210f", "value": "confirm-session-identification.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079345", "to_ids": true, "type": "domain", "uuid": "5c180a31-4604-43df-aa60-4822950d210f", "value": "confirm-session-identifier.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079345", "to_ids": true, "type": "domain", "uuid": "5c180a31-6cf4-4e8a-b6b3-4033950d210f", "value": "confirmation-service.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079346", "to_ids": true, "type": "domain", "uuid": "5c180a32-b96c-4692-9c9d-4883950d210f", "value": "customer-recovery.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079346", "to_ids": true, "type": "domain", "uuid": "5c180a32-9f34-438b-a2c3-4539950d210f", "value": "customize-identity.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079347", "to_ids": true, "type": "domain", "uuid": "5c180a33-5000-4a32-90e9-47d8950d210f", "value": "document-share.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079347", "to_ids": true, "type": "hostname", "uuid": "5c180a33-a610-44c9-b811-433c950d210f", "value": "document.support-recoverycustomers.services" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079348", "to_ids": true, "type": "domain", "uuid": "5c180a34-2f0c-4679-b8ef-4d1f950d210f", "value": "documentofficupdate.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079348", "to_ids": true, "type": "hostname", "uuid": "5c180a34-97e0-42c9-9ee0-49ed950d210f", "value": "documents.accounts-support.services" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079348", "to_ids": true, "type": "domain", "uuid": "5c180a34-74a0-464e-b821-4b8b950d210f", "value": "documentsfilesharing.cloud" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079349", "to_ids": true, "type": "domain", "uuid": "5c180a35-2fec-4496-ba64-43cb950d210f", "value": "email-delivery.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079349", "to_ids": true, "type": "hostname", "uuid": "5c180a35-733c-414d-bca8-4060950d210f", "value": "mobile-sessionid.customize-identity.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079350", "to_ids": true, "type": "hostname", "uuid": "5c180a36-16d4-4755-a27d-493d950d210f", "value": "mobiles-sessionid.customize-identity.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079350", "to_ids": true, "type": "domain", "uuid": "5c180a36-ae74-471f-a417-4cd5950d210f", "value": "my-scribdinc.online" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079351", "to_ids": true, "type": "hostname", "uuid": "5c180a37-30b0-4c44-bfde-479c950d210f", "value": "myyahoo.ddns.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079352", "to_ids": true, "type": "domain", "uuid": "5c180a38-f69c-490a-9371-48ec950d210f", "value": "notificationapp.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079352", "to_ids": true, "type": "hostname", "uuid": "5c180a38-d84c-44b9-b9a0-419c950d210f", "value": "onlinemessenger.com-identifier-servicelog.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079353", "to_ids": true, "type": "domain", "uuid": "5c180a39-bf3c-4957-aa12-410d950d210f", "value": "podcastmedia.online" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079353", "to_ids": true, "type": "domain", "uuid": "5c180a39-0e84-450b-a010-4743950d210f", "value": "recoveryusercustomer.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079354", "to_ids": true, "type": "domain", "uuid": "5c180a3a-e9e4-4a35-9236-4c9b950d210f", "value": "session-management.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079354", "to_ids": true, "type": "domain", "uuid": "5c180a3a-edb4-470d-a573-4bb6950d210f", "value": "support-recoverycustomers.services" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079355", "to_ids": true, "type": "domain", "uuid": "5c180a3b-377c-4067-bc6d-4f48950d210f", "value": "continue-session-identifier.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079355", "to_ids": true, "type": "domain", "uuid": "5c180a3b-a670-456f-a552-438d950d210f", "value": "mobilecontinue.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079356", "to_ids": true, "type": "hostname", "uuid": "5c180a3c-5cd0-46fe-9b40-4e15950d210f", "value": "session-identifier-webservice.mobilecontinue.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079356", "to_ids": true, "type": "domain", "uuid": "5c180a3c-99e8-44e8-af12-4db5950d210f", "value": "com-messengersaccount.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079357", "to_ids": true, "type": "domain", "uuid": "5c180a3d-67f8-42ba-a30b-4e60950d210f", "value": "invitation-to-messenger.space" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079357", "to_ids": true, "type": "domain", "uuid": "5c180a3d-fb3c-4c30-906a-41c7950d210f", "value": "confirm-identification.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079357", "to_ids": true, "type": "hostname", "uuid": "5c180a3d-01bc-448c-a56c-4f0c950d210f", "value": "mobile.confirm-identification.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079358", "to_ids": true, "type": "hostname", "uuid": "5c180a3e-b674-4eda-b244-4ccd950d210f", "value": "services.confirm-identification.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079358", "to_ids": true, "type": "domain", "uuid": "5c180a3e-322c-4fcf-8621-4ee3950d210f", "value": "mobile-messengerplus.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079359", "to_ids": true, "type": "hostname", "uuid": "5c180a3f-10e4-4cae-b8a6-4107950d210f", "value": "confirm.mobile-messengerplus.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079359", "to_ids": true, "type": "domain", "uuid": "5c180a3f-707c-4a70-a2f4-4af5950d210f", "value": "com-messengercenters.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079360", "to_ids": true, "type": "hostname", "uuid": "5c180a40-82e4-4b15-ab28-4849950d210f", "value": "securemail.mobile-messengerplus.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079360", "to_ids": true, "type": "hostname", "uuid": "5c180a40-7db0-4b32-8706-4c1a950d210f", "value": "documents.mobile-messengerplus.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079361", "to_ids": true, "type": "domain", "uuid": "5c180a41-90dc-4962-8feb-4d85950d210f", "value": "confirm-identity.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079361", "to_ids": true, "type": "domain", "uuid": "5c180a41-f198-481f-95ba-454f950d210f", "value": "identifier-sessions-mailactivityid.site" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079361", "to_ids": true, "type": "hostname", "uuid": "5c180a41-fa24-445c-8161-4c6b950d210f", "value": "activatecodeoption.ddns.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079362", "to_ids": true, "type": "hostname", "uuid": "5c180a42-3694-4965-9260-4f92950d210f", "value": "broadcastpopuer.ddns.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079362", "to_ids": true, "type": "hostname", "uuid": "5c180a42-3208-42cc-9332-44b3950d210f", "value": "books.com-identifier-servicelog.name" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079363", "to_ids": true, "type": "hostname", "uuid": "5c180a43-f5e4-46ac-b565-43c0950d210f", "value": "mb.sessions-identifier-memberemailid.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079363", "to_ids": true, "type": "domain", "uuid": "5c180a43-9a2c-478a-b77e-4977950d210f", "value": "sessions-identifier-memberemailid.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079364", "to_ids": true, "type": "hostname", "uuid": "5c180a44-085c-4aca-a0bf-43d0950d210f", "value": "sessions.mobile-messengerplus.network" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079364", "to_ids": true, "type": "domain", "uuid": "5c180a44-7c4c-425c-ae6d-44a6950d210f", "value": "confirm-verification-process.systems" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079365", "to_ids": true, "type": "hostname", "uuid": "5c180a45-9334-4b84-97a7-472c950d210f", "value": "accounts.confirm-verification-process.systems" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079365", "to_ids": true, "type": "hostname", "uuid": "5c180a45-145c-4389-bd86-4298950d210f", "value": "broadcastnews.ddns.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079366", "to_ids": true, "type": "domain", "uuid": "5c180a46-7180-4780-ba2d-45cb950d210f", "value": "account-profile-users.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079366", "to_ids": true, "type": "domain", "uuid": "5c180a46-5a14-4b04-80b3-45b8950d210f", "value": "us2-mail-login-profile.site" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079367", "to_ids": true, "type": "hostname", "uuid": "5c180a47-49d0-47a6-9c89-40de950d210f", "value": "us2.login-users-account.site" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079367", "to_ids": true, "type": "domain", "uuid": "5c180a47-8b30-4af4-bd3f-43ec950d210f", "value": "login-users-account.site" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079367", "to_ids": true, "type": "hostname", "uuid": "5c180a47-3c6c-4e1c-9d39-4b50950d210f", "value": "live.account-profile-users.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079368", "to_ids": true, "type": "hostname", "uuid": "5c180a48-c034-48f8-a247-4205950d210f", "value": "signin.account-profile-users.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079368", "to_ids": true, "type": "hostname", "uuid": "5c180a48-8990-4724-acaa-4110950d210f", "value": "aol.account-profile-users.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1545079369", "to_ids": true, "type": "domain", "uuid": "5c180a49-5600-49ec-ba9a-49d3950d210f", "value": "users-account.site" } ] } }