GreenCharlie

An Iran-linked infrastructure and intrusion cluster that overlaps with APT42, Charming Kitten, Magic Hound, and TA453. It conducts credential phishing and espionage against government, political, defense, and policy targets, including campaigns using POWERSTAR- and GORBLE-related tooling.