GreenCharlie
GreenCharlie is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in the United States.
- Origin
- Iran
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2020
- Record updated
Who They Target.
About GreenCharlie.
In August 2024, open sources revealed that US political campaign officials and affiliates were targeted as part of Mint Sandstorm and {{APT 42}} operations. In this report, we discuss threat activity associated with the Iran-nexus group we track as GreenCharlie, which overlaps with {{Magic Hound, APT 35, Cobalt Illusion, Charming Kitten}}. Our global Network Intelligence capability has allowed us to identify and track a large and rapidly evolving cluster of infrastructure used to support GreenCharlie cyber-espionage campaigns. Now, we have been able to link this network to the recent targeting of US political campaigns.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.