Proofpoint details TA453’s irregular campaigns (2020–2022), showing a shift toward compromised accounts, malware, and confrontational lures with possible IRGC support. The report highlights the Samantha Wolf persona and aggressive outreach suggesting TA453’s ties to IRGC intelligence and potential kinetic operations. #TA453 #CharmingKitten #IRGC #GhostEcho #SamanthaWolf
Keypoints
- TA453 exhibited campaigns departing from its usual phishing methods and victim profiles from late 2020 through 2022.
- The outliers leveraged compromised accounts, malware (GhostEcho/CharmPower), and confrontational lures to reach diverse targets (medical researchers, realtors, travel agencies, etc.).
- Proofpoint ties this irregular activity with IRGC intelligence requirements, with moderate confidence of broader IRGC involvement and potential kinetic support.
- TA453 is tracked as having about six subgroups, differentiated by victimology, techniques, and infrastructure, but sharing a focus on academics, diplomats, journalists, and researchers in the Middle East.
- Notable campaigns include targeting medical researchers, aerospace engineers, travel agencies, and a Florida realtor, using credential harvesting links and benign conversations to winnow targets.
- The Samantha Wolf persona embodies confrontational social engineering to provoke responses and urgency, expanding TA453’s tactic toolkit in 2022.
MITRE Techniques
- [T1566.002] Phishing: Spearphishing Link – Delivering credential harvesting links via emails to gain access to targets’ inboxes. “delivers credential harvesting links with the intent of gaining access to a target’s inbox for exfiltration of email content.”
- [T1566.001] Phishing: Spearphishing Attachment – Lure using a malicious document with remote template injection to download payloads. “This document, which was uploaded to VirusTotal, used remote template injection to download multiple .dotm files from office-updates[.]info…”
- [T1059.001] Command and Scripting Interpreter: PowerShell – GhostEcho backdoor delivered as a PowerShell-based foothold. “GhostEcho (CharmPower), a PowerShell backdoor… a lightweight first stage used to deliver follow-on espionage…”
- [T1114] Email Collection – Gaining access to target inboxes to exfiltrate email content. “intent of gaining access to a target’s inbox for exfiltration of email content”
- [T1078] Valid Accounts – Use of compromised accounts to target individuals rather than relying solely on actor-controlled accounts. “compromised accounts… to target individuals”
Indicators of Compromise
- [Email Address] – [email protected] – Used in the Samantha Wolf lure to target Middle Eastern energy-sector contacts and US/European officials.
- [Domain] – bnt2.live, nco2.live – Actor-controlled URL shorteners redirecting to credential harvesting pages.
- [Domain] – office-updates.info, profilepic.site, gettogether.quest, css-ethz.ch – Domains used for hosting payloads, tracking pixels, and spoofed infrastructure.
- [IP Address] – 66.29.153.90 – Shared infrastructure hosting related TA453 activity (gettogether.quest since mid-April 2022).
- [File Hash] – a8c062846411d3fb8ceb0b2fe34389c4910a4887cd39552d30e6a03a02f4cc78 – Hash linked to the Samantha Wolf lure document and TA453 campaign chain.
Read more: https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations