Researchers Learn From Nation-State Attackers OpSec Mistakes

Security researchers discuss how a series of simple and consistent mistakes helped them learn more about ITG18, better known as Charming Kitten.

When security intelligence teams talk about human error, the conversation typically focuses on the victim of a cyberattack. What might they learn if they analyzed attackers mistakes instead?
In their investigation of a group tracked as ITG18, otherwise known as Charming Kitten and Phosphorous, a team of IBM X-Force security researchers investigated attackers operational security errors to reveal the inner details of how the group functions and launches attacks.
ITG18, associated with Iranian government operations, has a history of targeting high-profile victims, journalists,
nuclear scientists
, and people involved with COVID-19 vaccine development. In late 2019, it was linked to an attack
targeting
a US presidential campaign; earlier that year, Microsoft
took down
99 websites the group used to launch phishing attacks.
How we define this group is theyre primarily focused on phishing and targeting personal accounts, although theres evidence that they may also go after corporate accounts as well, says Richard Emerson, senior threat hunt analyst with IBM X-Force. Researchers estimate its a rather sizable organization based on the amount of infrastructure it has registered —Emerson notes they have some 2,000 indicators tied to this group alone over the past couple of years.
It was when the team was researching an attack on executives at a COVID-19 research facility that it had a huge breakthrough in analyzing ITG18 activity, says Allison Wikoff, senior strategic cyber-threat analyst with IBM X-Force. Researchers routinely collect indicators associated with attackers operations; as the team investigated ITG18s activity, they found errors in how attackers infrastructure was set up, which led to a wealth of new information.
When we saw this open server, we collected videos and exfiltrated information, she continues. Over the course of the last 18 months, weve continually seen the same errors from this group. These errors have the dual effect of highlighting the mistakes adversaries make and how this gives researchers and defenders an advantage, she adds.
Among the information researchers found were training videos used within the group. These specifically cover how the group configures compromised email accounts to maintain access, how attackers exfiltrate data, and how they expand on compromises with stolen information. The videos helped researchers gain more insight into the operations, but the errors continued.
[Wikoff and Emerson will discuss their findings and show the training videos they discovered at an upcoming Black Hat USA briefing,
The Kitten that Charmed Me: The 9 Lives of a Nation State Attacker
, on Aug. 4 and 5]
One of the persistent makes ITG18 makes is misconfiguring their servers to leave listable directories, Emerson says. When someone navigates to the IP address or domain, they can view the files without authentication. Theyre just open to the public, essentially, for anyone to look at, he notes.
The group stores their exfiltrated information on several of these servers, where anyone could find large, archived files ranging anywhere from 1GB to 100–150GB — and all of this could pertain to a single targeted individual, Emerson adds.
Researchers have also seen ITG18 storing tools, some legitimate and some custom, on these misconfigured servers. Emerson and Wikoff point to the groups new Android remote access Trojan, which is used to infect the victims they follow on a daily basis. They nicknamed the code LittleLooter. Having access to this, as well as their other findings, has helped the research team better understand tactical aspects of how the attack group works.
What Researchers & Defenders Can Learn
ITG18s mistakes have helped Emerson and Wikoff paint a more detailed picture of how the group operates and hypothesize what its activity will look like in the future. The attacks arent all that sophisticated, Wikoff notes, and the research suggests they are unlikely to evolve.
The interesting thing about this particular group is that the tactics havent really changed all that much in the four to five years [we] have been laser focused on it, she says. Others have reported on ITG18s misconfigured servers in the past, so its likely the attackers are aware of the issue but havent addressed it. It seems the group either doesnt care to address the mistake, doesnt want to change their operational cadence, or there could be another factor at play.
While many defensive tips are not unique to ITG18 — multifactor authentication is a big deterrent for these attackers — this group is tricky because they primarily target personal resources, Wikoff points out.
Weve got very, very personal information about where people have gone on vacation, weve got voice recordings, all of this information was exfiltrated from several victims, she says. That builds a very strong profile that can be used for future social engineering campaigns against the individual or the organization they work with.
While organizations own their employees personal resources, these attacks could affect enterprise security. Emerson advises businesses to consider how they might respond if an employee is affected in one of these attacks, and how they can train employees to be aware of the threats they face.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Learn From Nation-State Attackers OpSec Mistakes