Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The UNK_SmudgedSerpent threat actor, likely linked to Iranian espionage efforts, targeted academics and foreign policy experts from June to August 2025 using phishing campaigns with domestic political and health-related lures. The actor employed Remote Management & Monitoring (RMM) tools and credential harvesting techniques, showing overlapping tactics with known Iranian groups such as TA455, TA453, and TA450. Although attribution is not definitive, the targeting aligns with Iranian intelligence priorities, focusing on sensitive policy and academic sectors. The campaign's medium severity reflects moderate impact potential without known exploits in the wild. European organizations involved in foreign policy, academia, and research are at risk, especially in countries with strong diplomatic ties or geopolitical interest in Iran. Mitigation requires targeted user awareness, strict monitoring of RMM tool usage, and enhanced email filtering tuned to political and health-themed lures. Countries like Germany, France, the UK, Italy, and the Netherlands are most likely affected due to their active academic communities and diplomatic engagement with Iran. The threat's medium severity is due to its espionage focus, moderate ease of exploitation via phishing, and the absence of widespread destructive payloads or zero-day exploits. Defenders should prioritize detection of credential harvesting and suspicious RMM activity while maintaining vigilance for evolving Iranian espionage tactics.

The UNK_SmudgedSerpent campaign represents a sophisticated espionage operation attributed to an Iranian-aligned threat actor targeting academics and foreign policy experts between June and August 2025. The actor leveraged phishing attacks using lures related to Iranian domestic politics and health topics, aiming to harvest credentials and gain persistent access. They utilized Remote Management & Monitoring (RMM) tools such as ISL Online, Minibike, Minijunk, and PDQConnect to maintain control and conduct reconnaissance. The campaign's tactics, techniques, and procedures (TTPs) overlap with known Iranian groups TA455, TA453, and TA450, suggesting shared resources or collaboration among Iranian intelligence agencies. Techniques observed include command execution (T1059 variants), credential dumping (T1087), phishing (T1566), lateral movement, and use of remote services (T1133). The actor's targeting of policy experts and academics aligns with Iranian strategic intelligence priorities, focusing on gathering sensitive geopolitical information. No known exploits or destructive payloads were identified, and the campaign primarily focused on espionage and credential harvesting. Attribution challenges remain due to tactic convergence and potential false flags. The campaign highlights the evolving sophistication of Iranian espionage operations, blending social engineering with legitimate remote management tools to evade detection and maintain persistence.

Detailed information about Crossed wires: a case study of Iranian espionage and attribution. Get real-time updates, technical details, and mitigation strategies

Crossed wires: a case study of Iranian espionage and attribution - Live Threat Intelligence - Threat Radar | OffSeq.com

Crossed wires: a case study of Iranian espionage and attribution

Title	Severity	Type	Source	Date

Threats Tagged 'overlapping ttps'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'overlapping ttps'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility