Iran-Linked RedKitten Cyber Campaign Targets Human Rights NGOs and Activists

A Farsi-speaking, Iran-aligned actor (RedKitten) is running targeted phishing and malware operations against NGOs and individuals documenting protests: macro-laced Excel lures drop a C# backdoor (SloppyMIO) via AppDomainManager injection, the implant retrieves steganographic configuration from images hosted via GitHub/Google Drive and uses the Telegram Bot API for C2, supporting modules to run commands, exfiltrate files, deploy payloads, and persist via scheduled tasks; separate phishing infrastructure also harvests WhatsApp and Gmail credentials, and the campaign shows signs of LLM-assisted tooling.