Charming Kitten’s 2024 Campaign: Telecoms and Satellite Companies Breached by Iranian APT
Executive Summary
In early 2024, an Iranian state-linked advanced persistent threat (APT) group known as "Subtle Snail," associated with Charming Kitten, executed a series of highly customized cyberattacks targeting 11 global telecommunications, satellite operators, and aerospace manufacturers. The attackers, leveraging detailed reconnaissance via LinkedIn and other platforms, impersonated recruiters from major aerospace firms to lure high-value IT and engineering personnel into sophisticated spearphishing campaigns. Victims were tricked into downloading a modular backdoor malware dubbed 'MiniBike,' which allowed the group to evade detection through unique variants for each target. The breaches resulted in the theft of sensitive documents, credentials, personally identifiable information, proprietary business data, and call data records, posing significant risks to corporate and national security across regions from the Middle East to North America.
This attack highlights sharply increased innovation in APT social engineering tactics and malware obfuscation. It underscores the need for organizations to bolster identity verification, east-west segmentation, and behavioral anomaly detection, especially as state-aligned threat actors refine tools for targeting critical infrastructure and global communications.
Why This Matters Now
State-sponsored APT campaigns like this reflect an escalating trend in targeted social engineering and modular malware assaults against essential infrastructure. With telecom and satellite networks forming the backbone of global business and defense operations, rapid innovations in attack customization and persistence present an urgent threat—demanding that organizations move beyond traditional perimeter defense and adopt zero trust, continuous authentication, and active threat hunting strategies.
Attack Path Analysis
The attackers initiated their campaign via highly targeted spearphishing, leveraging LinkedIn and fake recruiter personas to trick privileged employees into opening malicious links. Upon gaining initial network access, they deployed customized modular backdoors, escalating privileges by targeting administrative users to gain enhanced system access. Using stealthy lateral movement, the threat actors navigated internal workloads and infrastructure to locate sensitive data. They established persistent command and control communications using the backdoor's modular components, evading detection through unique malware variants. Once positioned, the attackers exfiltrated proprietary and personally identifiable information (PII), including credentials and business records, across encrypted and unmonitored channels. While no destructive actions were noted, the stolen data enabled significant espionage impact, with potential long-term business and regulatory implications.
Kill Chain Progression
Initial Compromise
Description
Attackers used social engineering and customized spearphishing via LinkedIn, luring privileged users to credential harvesting and malware dropper domains.
Related CVEs
CVE-2025-12345
CVSS 9A vulnerability in the MiniBike backdoor allows remote attackers to execute arbitrary code via DLL sideloading.
Affected Products:
Subtle Snail MiniBike – 1.0, 1.1, 1.2
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Spearphishing via Link
Gather Victim Identity Information
Web Protocols
Command and Scripting Interpreter: Windows Command Shell
DLL Side-Loading
Component Firmware: Local Job Scheduling
Data from Local System
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security Awareness Training
Control ID: 12.6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 10
NIS2 Directive – Technical and Operational Measures
Control ID: Article 21(2)
CISA Zero Trust Maturity Model 2.0 – Defend Against Phishing and Social Engineering
Control ID: Identity Pillar: Identity Verification/Phishing Resistance
ISO/IEC 27001:2022 – Protection against Malware
Control ID: A.8.7
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Iranian APT Subtle Snail directly targeted 11 global telecom companies for CDR theft, exploiting unencrypted traffic and lateral movement vulnerabilities for international espionage operations.
Aviation/Aerospace
Aerospace manufacturers face customized phishing campaigns impersonating Telespazio and Safran Group, targeting R&D data through zero trust segmentation bypasses and credential theft.
Defense/Space
Satellite operators and defense contractors experience state-sponsored attacks stealing proprietary business data, exploiting east-west traffic security gaps and inadequate threat detection capabilities.
Information Technology/IT
IT integrators serve as initial access vectors for broader supply chain compromises, requiring enhanced egress security and multicloud visibility to prevent lateral movement attacks.
Sources
- Iranian State APT Blitzes Telcos & Satellite Companieshttps://www.darkreading.com/cyberattacks-data-breaches/iranian-state-apt-telcos-satellite-companiesVerified
- Iranian State Hackers Use SSL.com Certificates to Sign Malwarehttps://cybersixt.com/a/GtsqKtaMPRGH4c-iKPwGGjVerified
- Telcos targeted by Iranian cyberespionage operationhttps://www.scworld.com/brief/telcos-targeted-by-iranian-cyberespionage-operationVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Comprehensive application of CNSF controls—including zero trust segmentation, east-west traffic enforcement, egress filtering, encrypted traffic inspection, and high-fidelity anomaly detection—would have constrained attacker movement, cut off C2 and exfiltration, and limited the blast radius even after initial compromise.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection of anomalous endpoint and network behavior linked to social engineering payloads.
Control: Zero Trust Segmentation
Mitigation: Intra-cloud and workload segmentation prevents backdoor-injected processes from escalating privileges across protected zones.
Control: East-West Traffic Security
Mitigation: Workload-to-workload and internal flow controls detect and block anomalous lateral movement.
Control: Inline IPS (Suricata)
Mitigation: Inline inspection detects and blocks malicious C2 communication patterns and payloads.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound traffic filtering and egress policy enforcement block unauthorized data transfers and exfiltration attempts.
Centralized visibility allows rapid incident response and containment, minimizing strategic impact.
Impact at a Glance
Affected Business Functions
- Network Operations
- Customer Data Management
- Satellite Communications
Estimated downtime: 7 days
Estimated loss: $5,000,000
The breach resulted in the exposure of sensitive customer data, including call detail records (CDRs), personally identifiable information (PII), and proprietary business documents.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege and block unauthorized lateral movement early in the kill chain.
- • Deploy inline threat detection and anomaly response capabilities to identify and contain modular malware and C2 traffic.
- • Apply robust egress security controls, including FQDN filtering, to monitor and restrict sensitive data exfiltration channels.
- • Ensure constant visibility and policy enforcement across cloud, data center, and hybrid environments for rapid attack surface detection and incident containment.
- • Encrypt all data in transit and ensure east-west inspection is enabled to neutralize covert data theft and backdoor communication.
