Iranian-Dream-Job-ver1.pdf

ClearSky details an active Iranian TA455 (Charming Kitten) cyber-espionage campaign — the "Iranian Dream Job" — which uses fake recruiter profiles and a malicious site (careers2find.com) to distribute SnailResin via SignedConnection.zip and DLL side-loading; the campaign uses GitHub-hosted encoded C2, Cloudflare masking, and targeted social engineering against aerospace/defense personnel, with provided technical analysis, TTP mappings, infrastructure linkage, and IoCs (domains, IPs, SHA1 hashes).