RedKitten campaign targeting Iranian dissidents with forged shock lures
Campaign
Summary
Hide ▲
Show ▼
The RedKitten campaign is spreading SloppyMIO malware in Iran, putting NGOs and people documenting protest-related human rights abuses at risk of surveillance and data theft. The operation uses forged shock lures and malicious Excel files to trigger macros and deliver a persistent implant. Researchers first observed the activity in early January 2026, and they said it overlaps with Iran-aligned TTPs. The targeting focus suggests a coordinated effort against dissidents, activists, journalists, and families searching for missing loved ones.
Related Happenings
Ghostwriter geofenced PDF spear-phishing campaign targeting Ukrainian government entities
Campaign
H score50
First: 14.05.2026 17:00
Last: 14.05.2026 17:00
Sources 1
About this happening:
The Ghostwriter / FrostyNeighbor group is running a geofenced spear-phishing campaign against government entities in Ukraine, and the operation matters because it deli...
Ghostwriter geofenced PDF spear-phishing campaign targeting Ukrainian government entities
CampaignAbout this happening: The Ghostwriter / FrostyNeighbor group is running a geofenced spear-phishing campaign against government entities in Ukraine, and the operation matters because it deli...
REF6598 Obsidian social-engineering campaign targeting finance and crypto users
Campaign
H score35
First: 16.04.2026 14:02
Last: 16.04.2026 14:02
Sources 1
About this happening:
The REF6598 operation is using LinkedIn, Telegram, and Obsidian to deliver PHANTOMPULSE, creating a targeted intrusion path into financial and cryptocurr...
REF6598 Obsidian social-engineering campaign targeting finance and crypto users
CampaignAbout this happening: The REF6598 operation is using LinkedIn, Telegram, and Obsidian to deliver PHANTOMPULSE, creating a targeted intrusion path into financial and cryptocurr...
Iranian MOIS Telegram malware campaign targeting opposition groups
Campaign
H score32
First: 23.03.2026 11:45
Last: 23.03.2026 11:45
Sources 1
About this happening:
The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Iranian MOIS Telegram malware campaign targeting opposition groups
CampaignAbout this happening: The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Transparent Tribe AI-assisted implant campaign targeting India
Campaign
H score32
First: 06.03.2026 17:11
Last: 06.03.2026 17:11
Sources 1
About this happening:
Transparent Tribe (APT36) is using AI-powered coding tools to mass-produce disposable implants in an active campaign targeting the Indian government, its embassies...
Transparent Tribe AI-assisted implant campaign targeting India
CampaignAbout this happening: Transparent Tribe (APT36) is using AI-powered coding tools to mass-produce disposable implants in an active campaign targeting the Indian government, its embassies...
Anonymous Fénix DDoS and volunteer-recruitment campaign
Campaign
H score29
First: 23.02.2026 23:59
Last: 23.02.2026 23:59
Sources 1
About this happening:
Anonymous Fénix escalated its DDoS campaign by recruiting volunteers, increasing disruption risk for government and public-institution domains across Spain and par...
Anonymous Fénix DDoS and volunteer-recruitment campaign
CampaignAbout this happening: Anonymous Fénix escalated its DDoS campaign by recruiting volunteers, increasing disruption risk for government and public-institution domains across Spain and par...
Timeline
-
23.01.2026 02:00 2 articles · 5mo ago
HarfangLab obtains RedKitten samples
Detection Ioc UpdateHarfangLab obtained malicious samples tied to the RedKitten campaign targeting people in Iran, including NGOs, activists, journalists and families documenting human rights abuses, after first observing the activity in early January 2026.
Show sources
- New AI-Developed Malware Campaign Targets Iranian Protests — www.infosecurity-magazine.com — 30.01.2026 13:55
- New AI-Developed Malware Campaign Targets Iranian Protests — www.infosecurity-magazine.com — 30.01.2026 13:55