Security researchers have linked a late-2020 phishing campaign to an advanced persistent threat group with links to Iran. Charming Kitten, believed to be an Iranian state-sponsored APT, has built a vast espionage apparatus comprised of at least 85 IP addresses, hundreds of hosts and 240 malicious domains. Spearphishing and custom malware are among an array of tactics the group uses against victims. The group was also seen last July targeting Israeli scholars and U.S. government employees in another credential-stealing effort.
Source: https://threatpost.com/charming-kitten-pounces-on-researchers/165129/