APTs-Adversary-Simulation/Iranian APT/Charming Kitten

Charming Kitten APT Adversary Simulation

This is a simulation of an attack by the APT group Charming Kitten, targeting multiple sectors including government, military, and critical infrastructure across the Middle East. The group’s targeting has expanded beyond government entities to include the maritime, aviation, and financial sectors, reflecting a growing interest in regional logistics and critical economic infrastructure.

Recent campaigns (Operation Olalampo) have targeted entities in Egypt, Saudi Arabia, the UAE, Turkey, Hungary, Turkmenistan, Israel, and South America. These attacks demonstrate the group’s ability to pivot between sectors while conducting multiple operations simultaneously. The campaign was active throughout 2025 and 2026. This simulation is based on research from

Palo Alto Unit 42: https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/

and Group-IB: https://www.group-ib.com/blog/muddywater-operation-olalampo/

In this campaign, the blurred document lure delivers a new payload as a custom HTTP backdoor. To maintain persistence, the group has evolved its development approach by leveraging AI-generated code and Rust-based tools, such as the BlackBeard backdoor, to rapidly deploy custom implants. Additionally, the group uses standard HTTP status codes, customized UDP based traffic, and the Telegram API for C2 communications.

The first stage (delivery technique)

The initial campaign targeted project engineers using industry-specific terminology for subsea pipelines. The lure document was blurred in order to deceive targets into clicking “Enable Content” thereby triggering the execution of the embedded macro.

In another wave the attack group delivered a malicious Excel and Word files designed to mimic the target’s internal financial records. The lure appeared as a legitimate spreadsheet containing payment details and cash flow projections.

The infected document included specific references to “Engineering, Construction & Marine Services” and used local currency (AED), along with realistic transaction descriptions such as “Payroll Payments via WPS” making it highly convincing to the target.

• Exploiting Trusted Relationships for Payload Delivery

Throughout the past year, Charming Kitten systematically abused trusted relationships by hijacking official government and corporate email accounts to bypass traditional email security controls and filtering mechanisms. This technique was observed in more than 15 targeted operations conducted across multiple regions worldwide.

In August 2025, the group leveraged a compromised mailbox belonging to the Omani Ministry of Foreign Affairs to distribute malicious documents to foreign ministries and diplomatic entities in several countries. The delivered files were disguised as legitimate diplomatic communications and official government correspondence, increasing the likelihood of recipient interaction and trust.

Following the regional conflicts in June 2025, the group also launched a themed phishing campaign using a “Sustainable Peace” seminar invitation as a lure. The invitation was crafted to appear as a legitimate geopolitical or diplomatic event, aiming to encourage engagement from targeted individuals within government, policy, and international relations sectors.

These operations demonstrate the group’s continued reliance on social engineering, trusted relationship abuse, and geopolitical themes to enhance credibility and improve payload delivery success rates.

The second stage (Malicious VBA Macro with Conditional Download and Execution)

A special thanks to Mohamed Montaser for his valuable contribution to this adversary simulation project. He was responsible for developing and refining the VBA macro components used throughout this simulation. His expertise and contributions played an important role in making this project possible.

Sub love_me_____(): Acts as the primary controller for the entire macro, coordinating the payload workflow from start to finish. The routine begins by decoding an obfuscated file path from a hexadecimal string, concealing the actual location until runtime to reduce static detection. It then checks whether the target payload already exists on the system. If the file is found, the macro immediately transfers execution to the execution routine. If the file is not present, it invokes the download routine to retrieve the payload before executing it. This conditional logic allows the macro to support both first-time infections and subsequent executions without downloading the payload multiple times.

Sub DownloadAndRun: Responsible for retrieving the payload when it is not already available on the system. The function decodes a hexadecimal-encoded URL at runtime and uses the Windows HTTP API (WinHttp.WinHttpRequest) to request the remote file. If the download succeeds, the response is written to disk in binary format at the previously decoded file path. Once the file has been successfully saved, the function immediately invokes the execution routine, allowing the newly downloaded payload to run without requiring additional user interaction.

Function DecodeHex: Provides the string deobfuscation mechanism used throughout the macro. Rather than storing sensitive strings such as file paths or network locations in plain text, the macro represents them as hexadecimal data and reconstructs them only when needed. This technique is commonly used to obscure static indicators and reduce the visibility of embedded strings during basic inspection.

Sub ExecuteFile: Serves as the execution component of the macro. After receiving the target file path, it attempts to launch the payload using multiple execution methods. The routine first executes the file through the VBA Shell function with a hidden window and then invokes a secondary execution method through Windows Script Host, providing an alternative launch mechanism. Using more than one execution technique increases execution reliability if one method encounters an error.

Sub AutoOpen: Acts as the automatic entry point for the macro. When the Office document is opened and macros are enabled, this procedure is triggered automatically and immediately calls love_me_____(), initiating the complete workflow without requiring any further interaction from the user.

https://github.com/user-attachments/assets/ac4ea6ce-da0f-4e0a-a20f-fcc6c13e3eab

The Third Stage (Telegram-based Agent)

The initial objective of this stage is to enhance the realism of the adversary simulation by replacing the traditional direct command and control communication channel with a Telegram-based communication layer. Instead of requiring operators to interact with the payload through a dedicated control server, commands are exchanged through a Telegram bot, allowing the simulation to emulate an alternative communication workflow commonly observed in modern threat campaigns.

This phase focuses on demonstrating how a trusted cloud messaging platform can serve as an intermediary communication channel between the operator and the simulated implant. By leveraging Telegram as the transport layer, the simulation highlights how legitimate online services may be used to blend command and control traffic with normal network activity while maintaining reliable bidirectional communication.

The operator communicates with the Telegram bot by sending commands through a private Telegram chat. The bot acts as the communication gateway, relaying operator instructions to the simulated implant and returning execution results through the same encrypted channel. From the operator's perspective, Telegram becomes the primary interface for tasking the implant, while the underlying communication remains transparent to the simulation workflow.

This enhancement demonstrates an alternative command and control architecture that relies on widely used cloud messaging infrastructure instead of dedicated C2 servers, enabling defenders to better understand, analyze, and detect communication patterns associated with cloud-based adversary simulations.

---

To simulate the communication workflow observed during the analysis, I created a dedicated Telegram bot using BotFather, Telegram's official bot management service. Unlike traditional command and control infrastructures that depend on dedicated servers, fixed IP addresses, or custom domains, this simulation communicates exclusively through the Telegram Bot API over encrypted HTTPS connections.

Following the same communication model, I configured the bot with the Display Name Olalampo and the Username stager_51_bot. The bot token generated by BotFather serves as the authentication mechanism, allowing BEAR-C2 to establish communication with the Telegram Bot API without requiring a dedicated C2 server. This approach demonstrates how cloud messaging platforms can be incorporated into adversary simulations to emulate alternative command and control architectures.

Telegram API Setup

To enable BEAR-C2 to communicate with the Telegram account controlling the bot, I generated a Telegram API ID and API Hash through Telegram's developer portal. After registering a new application, these credentials were configured inside BEAR-C2, allowing the framework to authenticate and interact with the Telegram account used throughout the simulation.

CHAR.cpp Configuration

The final stage consisted of configuring the Telegram communication module inside CHAR.cpp. The Bot Token generated by BotFather was embedded into the agent, allowing it to authenticate with the Telegram Bot API and establish bidirectional communication with the operator.

Since Telegram limits a single text message to 4096 characters, the maximum message size was configured to 4000 characters to provide a safe transmission margin. Whenever a command produces output larger than the configured limit, CHAR.cpp automatically splits the data into multiple sequential messages before transmitting them. This mechanism ensures reliable delivery of large command outputs while remaining fully compatible with the Telegram Bot API and maintaining continuous communication throughout the simulation.

---

main(): Serves as the entry point of the payload and initializes the entire agent. After startup, it continuously communicates with the configured Telegram bot, periodically checking for new operator messages. Every incoming command is processed through the command dispatcher, while responses are returned back to the operator through the same communication channel. This continuous polling mechanism allows the agent to remain responsive throughout its execution.

get_updates: Acts as the communication receiver for the agent. It establishes secure HTTPS connections using the Windows WinHTTP API and continuously polls the Telegram Bot API for new messages. Each received update is parsed from JSON format before being forwarded to the message processing routine, allowing the payload to receive operator instructions remotely.

process_message: Functions as the command processor responsible for handling operator requests. It reconstructs multi-part messages, processes encoded commands when required, and forwards completed commands to the execution engine. Once execution is complete, large outputs are automatically divided into smaller chunks before being transmitted back to the operator, allowing lengthy responses to be delivered reliably through Telegram.

execute_command: Serves as the central dispatcher for all incoming tasks. It determines which internal functionality should be used based on the received instruction and routes the request to the appropriate component. Depending on the command type, it can invoke built-in file management capabilities, directory browsing routines, or the command execution engine before returning the collected results to the communication layer.

run_command: Acts as the local command execution engine. It creates hidden child processes, captures their standard output, and returns the generated results to the agent. The collected output is then passed back through the communication channel, allowing the operator to receive execution results remotely.

browse_directory: Provides remote directory enumeration capabilities by traversing the requested folder and collecting information about its contents. The gathered information is organized into structured JSON data before being returned to the communication layer, allowing the operator to remotely inspect directory structures.

download_file, upload_file, delete_file, and rename_file: Together these routines provide the agent's file management capabilities. They are responsible for handling file transfer operations, filesystem modifications, and basic file management tasks. Data exchanged during file transfers is encoded to ensure it can be transmitted safely through the communication channel before being reconstructed on the receiving side.

base64_encode, base64_decode, and decode_base64_command: These helper functions provide the encoding and decoding mechanisms used by the agent. They convert data between its original binary representation and Base64 format, allowing commands, files, and structured data to be safely transmitted through the messaging channel while supporting message reconstruction for larger payloads.

send_telegram_message: Acts as the outbound communication component of the agent. It formats execution results, prepares outgoing messages, and sends them back to the configured Telegram chat using HTTPS requests through the Telegram Bot API. Large outputs generated by the payload are transmitted in multiple parts to accommodate Telegram message size limitations.

The fourth stage (Payload Hosting and VBA Integration)

After completing the Telegram communication component, the next stage is to compile the payload, producing the final executable that will be delivered during the simulation. Once the build process is complete, the generated executable is uploaded to a file hosting service, which provides a direct download URL that can be accessed over HTTPS.

The generated download URL is then integrated into the VBA macro by replacing the placeholder URL with the actual hosting link. This allows the macro to retrieve the latest payload dynamically instead of embedding it directly inside the Office document, making the simulation more modular and allowing payload updates without modifying the macro itself.

When the document is opened and the macro is executed, it checks whether the payload already exists on the target system. If the file is not present, the macro silently downloads it from the configured hosting URL in the background, stores it in the predefined location, and immediately launches it. The entire process is performed without requiring additional user interaction, providing a seamless delivery workflow that closely resembles the staged payload delivery techniques commonly demonstrated in adversary simulation scenarios.

BEAR C2 – Telegram Command and Control

The final result of this enhancement is a fully integrated Telegram Command-and-Control (C2) channel within BEAR C2. Rather than serving as a standalone proof of concept, Telegram becomes a native communication channel that allows operators to manage active sessions directly from the BEAR C2 interface. The integration is powered by the Telethon library, enabling seamless interaction with the Telegram platform while abstracting the underlying communication from the operator.

Authentication and secure communication are handled through Telegram's MTProto protocol, which provides encrypted communication between BEAR C2 and the Telegram infrastructure. Operators simply configure their API ID, API Hash, phone number, and bot username within the Authentication settings, after which BEAR C2 establishes the connection and manages all Telegram-based communications automatically.

Once the integration is enabled, operators can issue commands, receive execution results, and monitor active sessions through the Telegram C2 channel without interacting directly with the Telegram Bot API. Command outputs are automatically collected and returned to the BEAR C2 interface, providing a centralized operational experience while leveraging Telegram as the underlying transport layer.

Telegram is one of several communication channels supported by BEAR C2. The framework is designed with a multi-channel C2 architecture that also supports other communication methods, such as Discord, allowing operators to choose the most appropriate transport for their adversary simulation scenarios.

More importantly, the Telegram integration extends beyond basic command relay. Once a session is established, operators gain access to the full capabilities of BEAR C2, including its Arsenal of post-exploitation tools and automation features. This enables operators to execute integrated tools, perform post-exploitation activities, manage sessions, and coordinate complex adversary simulation workflows from a single interface, providing a complete command-and-control experience rather than a simple proof-of-concept communication channel.

https://github.com/user-attachments/assets/4a9c562e-e9ff-44f0-b6a1-4ddcac94cf38

MITRE ATT&CK Techniques

Technique ID	Technique	Implementation
T1566.001	Phishing: Spearphishing Attachment	Delivers malicious Word and Excel documents through targeted spear-phishing campaigns using trusted and compromised email accounts.
T1199	Trusted Relationship	Uses compromised government and corporate email accounts to distribute phishing documents and bypass email security controls.
T1204.002	User Execution: Malicious File	Requires the victim to open the Office document and enable macros to initiate the infection chain.
T1059.005	Command and Scripting Interpreter: Visual Basic	Executes an obfuscated VBA macro that controls the complete payload workflow.
T1027	Obfuscated Files or Information	Hides URLs and file paths as hexadecimal strings and reconstructs them only at runtime.
T1140	Deobfuscate/Decode Files or Information	Decodes hexadecimal-encoded strings before downloading and executing the payload.
T1105	Ingress Tool Transfer	Downloads the payload from a remote HTTPS hosting service if it is not already present on the system.
T1071.001	Application Layer Protocol: Web Protocols	Uses WinHTTP over HTTPS to download payloads and communicate with the Telegram Bot API.
T1102.001	Web Service: Dead Drop Resolver	Leverages the Telegram Bot API as a legitimate cloud service for command and control communications.
T1132.001	Data Encoding: Standard Encoding	Encodes commands, files, and responses using Base64 for transmission through the Telegram communication channel.
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Executes operator-supplied commands through hidden child processes on the compromised host.
T1083	File and Directory Discovery	Enumerates remote directory contents and returns structured results to the operator.
T1106	Native API	Uses native Windows APIs including WinHTTP and Windows Script Host to download and execute the payload.