GreenCharlie Infrastructure Linked to US Political Campaign Targeting

Recorded Future’s Insikt Group identifies and tracks a cluster of Iran-linked malicious infrastructure attributed to a group it calls GreenCharlie, which overlaps with Mint Sandstorm/Charming Kitten/APT42. The report links GreenCharlie infrastructure to malware (GORBLE, POWERSTAR/CharmPower, TAMECAT) used in spearphishing campaigns targeting research, policy, diplomatic, and US political campaign-related targets; provides network intelligence, hosting/registrar patterns, ProtonVPN usage, IoCs (numerous DDNS domains, IPs, Iran-based IPs, and malware hashes), and ATT&CK technique mappings.