Charming Kitten Leak Exposes Key Personnel, Front Companies, and Thousands of Compromised Systems

Charming Kitten (APT35) internal leaks reveal named operators, front companies and payrolls, and technical evidence tying the group to long‑running intrusion campaigns that compromise VPN gateways, email servers and endpoint systems across governments, universities and telecoms; infection is achieved via spear‑phishing and malicious documents that load PowerShell-based payloads which persist as scheduled tasks and beacon to Iranian-controlled HTTPS servers for command-and-control and data exfiltration.