{
  "name": "Iranian Educated Manticore Targets Leading Tech Academics",
  "slug": "iranian-educated-manticore-targets-leading-tech-academics",
  "description": "The Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, cyber security experts and computer science professors. The attackers posed as fictitious assistants to technology executives or researchers, directing victims to fake Gmail login pages or Google Meet invitations. This allowed them to intercept passwords and 2FA codes, gaining unauthorized access to victims' accounts. The group used a custom phishing kit implemented as a Single Page Application built with React, supporting various Google authentication flows and enabling 2FA relay attacks. The infrastructure relied on over 130 unique domains resolving to multiple IP addresses. Despite increased exposure, Educated Manticore continues to pose a persistent threat, particularly to individuals in Israel during the Iran-Israel conflict escalation.",
  "published": "2025-06-26T19:01:42+00:00",
  "created_at": "2025-06-26T19:01:42+00:00",
  "modified_at": "2025-06-27T05:53:56+00:00",
  "created_at_opencti": "2025-06-26T19:01:42+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-06-26",
    "apt42",
    "charming kitten",
    "educated manticore",
    "iran"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "45.143.166.230"
      },
      {
        "id": "",
        "name": "91.222.173.141"
      },
      {
        "id": "",
        "name": "45.12.2.158"
      },
      {
        "id": "",
        "name": "2.56.126.230"
      },
      {
        "id": "",
        "name": "195.66.213.132"
      },
      {
        "id": "",
        "name": "194.61.120.185"
      },
      {
        "id": "",
        "name": "194.11.226.9"
      },
      {
        "id": "",
        "name": "194.11.226.46"
      },
      {
        "id": "",
        "name": "194.11.226.5"
      },
      {
        "id": "",
        "name": "194.11.226.29"
      },
      {
        "id": "",
        "name": "185.130.226.71"
      },
      {
        "id": "",
        "name": "146.19.254.238"
      },
      {
        "id": "",
        "name": "zra-roll.online"
      },
      {
        "id": "",
        "name": "yamal-group.online"
      },
      {
        "id": "",
        "name": "world-shop.online"
      },
      {
        "id": "",
        "name": "work-meeting.info"
      },
      {
        "id": "",
        "name": "word-course.online"
      },
      {
        "id": "",
        "name": "wood-house.online"
      },
      {
        "id": "",
        "name": "white-life.info"
      },
      {
        "id": "",
        "name": "white-life-bl.info"
      },
      {
        "id": "",
        "name": "white-car.online"
      },
      {
        "id": "",
        "name": "wer-d.info"
      },
      {
        "id": "",
        "name": "wash-less.online"
      },
      {
        "id": "",
        "name": "warplogic.pro"
      },
      {
        "id": "",
        "name": "warning-d.info"
      },
      {
        "id": "",
        "name": "ude-final.online"
      },
      {
        "id": "",
        "name": "tomas-company.online"
      },
      {
        "id": "",
        "name": "top-game.online"
      },
      {
        "id": "",
        "name": "thomas-mark.xyz"
      },
      {
        "id": "",
        "name": "teammate-live.online"
      },
      {
        "id": "",
        "name": "suite-moral.info"
      },
      {
        "id": "",
        "name": "storm-wave.online"
      },
      {
        "id": "",
        "name": "steve-brown.info"
      },
      {
        "id": "",
        "name": "stadium-fresh.online"
      },
      {
        "id": "",
        "name": "spring-club.info"
      },
      {
        "id": "",
        "name": "socks.beauty"
      },
      {
        "id": "",
        "name": "sky-writer.online"
      },
      {
        "id": "",
        "name": "show-verify.xyz"
      },
      {
        "id": "",
        "name": "shaer-likn.store"
      },
      {
        "id": "",
        "name": "shadow-network.best"
      },
      {
        "id": "",
        "name": "sendly-ink.shop"
      },
      {
        "id": "",
        "name": "royalsoul.online"
      },
      {
        "id": "",
        "name": "roland-cc.online"
      },
      {
        "id": "",
        "name": "reg-d.info"
      },
      {
        "id": "",
        "name": "ricardo-mell.online"
      },
      {
        "id": "",
        "name": "redirect-review.online"
      },
      {
        "id": "",
        "name": "rap-art.info"
      },
      {
        "id": "",
        "name": "reading-course.online"
      },
      {
        "id": "",
        "name": "ques-tion-ing.xyz"
      },
      {
        "id": "",
        "name": "ptr-cc.online"
      },
      {
        "id": "",
        "name": "prt-max.online"
      },
      {
        "id": "",
        "name": "prj-ph.info"
      },
      {
        "id": "",
        "name": "pnl-worth.online"
      },
      {
        "id": "",
        "name": "prj-pa.info"
      },
      {
        "id": "",
        "name": "ph-work.info"
      },
      {
        "id": "",
        "name": "ph-crtdomain.info"
      },
      {
        "id": "",
        "name": "platinum-cnt.info"
      },
      {
        "id": "",
        "name": "panel-redirect.online"
      },
      {
        "id": "",
        "name": "panel-network.online"
      },
      {
        "id": "",
        "name": "panel-meeting.info"
      },
      {
        "id": "",
        "name": "pa-crtdomain.info"
      },
      {
        "id": "",
        "name": "optio-nalynk.online"
      },
      {
        "id": "",
        "name": "ntp-clock-p.info"
      },
      {
        "id": "",
        "name": "online-room.online"
      },
      {
        "id": "",
        "name": "ntp-clock-h.info"
      },
      {
        "id": "",
        "name": "normal-dmn.info"
      },
      {
        "id": "",
        "name": "nsim-pa.info"
      },
      {
        "id": "",
        "name": "nsim-ph.info"
      },
      {
        "id": "",
        "name": "nice-goods.online"
      },
      {
        "id": "",
        "name": "network-show.online"
      },
      {
        "id": "",
        "name": "network-show-a.online"
      },
      {
        "id": "",
        "name": "network-review.xyz"
      },
      {
        "id": "",
        "name": "network-game.xyz"
      },
      {
        "id": "",
        "name": "message-live.online"
      },
      {
        "id": "",
        "name": "master-club.info"
      },
      {
        "id": "",
        "name": "meet-work.info"
      },
      {
        "id": "",
        "name": "make-house.online"
      },
      {
        "id": "",
        "name": "lynda-tricks.online"
      },
      {
        "id": "",
        "name": "loads-ideas.online"
      },
      {
        "id": "",
        "name": "live-message.online"
      },
      {
        "id": "",
        "name": "live-meet.cloud"
      },
      {
        "id": "",
        "name": "live-meet.info"
      },
      {
        "id": "",
        "name": "live-meet.live"
      },
      {
        "id": "",
        "name": "live-meet.cfd"
      },
      {
        "id": "",
        "name": "live-gml.online"
      },
      {
        "id": "",
        "name": "live-meet.blog"
      },
      {
        "id": "",
        "name": "live-conn.online"
      },
      {
        "id": "",
        "name": "live-content.online"
      },
      {
        "id": "",
        "name": "live-coaching.online"
      },
      {
        "id": "",
        "name": "lesson-first.info"
      },
      {
        "id": "",
        "name": "lenan-rex.online"
      },
      {
        "id": "",
        "name": "infinit-world.info"
      },
      {
        "id": "",
        "name": "idea-home.online"
      },
      {
        "id": "",
        "name": "human-fly900.online"
      },
      {
        "id": "",
        "name": "hrd-dmn.info"
      },
      {
        "id": "",
        "name": "healthy-lifestyle.fit"
      },
      {
        "id": "",
        "name": "goods-companies.online"
      },
      {
        "id": "",
        "name": "good-student.online"
      },
      {
        "id": "",
        "name": "good-news.cfd"
      },
      {
        "id": "",
        "name": "gallery-shop.online"
      },
      {
        "id": "",
        "name": "food-tips-blog.online"
      },
      {
        "id": "",
        "name": "first-course.online"
      },
      {
        "id": "",
        "name": "expressmarket.online"
      },
      {
        "id": "",
        "name": "exir-juice.online"
      },
      {
        "id": "",
        "name": "everything-here.info"
      },
      {
        "id": "",
        "name": "encryption-redirect.online"
      },
      {
        "id": "",
        "name": "est5090.online"
      },
      {
        "id": "",
        "name": "door-black-meter.online"
      },
      {
        "id": "",
        "name": "dmn-for-hall.online"
      },
      {
        "id": "",
        "name": "dmn-for-car.online"
      },
      {
        "id": "",
        "name": "cyberlattice.pro"
      },
      {
        "id": "",
        "name": "crysus-p.info"
      },
      {
        "id": "",
        "name": "crysus-h.info"
      },
      {
        "id": "",
        "name": "course-math.info"
      },
      {
        "id": "",
        "name": "cook-tips.info"
      },
      {
        "id": "",
        "name": "connect-room.online"
      },
      {
        "id": "",
        "name": "conn-ectionor.cfd"
      },
      {
        "id": "",
        "name": "clothes-show.online"
      },
      {
        "id": "",
        "name": "cloth-model.blog"
      },
      {
        "id": "",
        "name": "cc-newton.info"
      },
      {
        "id": "",
        "name": "city-splash.online"
      },
      {
        "id": "",
        "name": "clame-rade.online"
      },
      {
        "id": "",
        "name": "book-handwrite.online"
      },
      {
        "id": "",
        "name": "bracs-lion.online"
      },
      {
        "id": "",
        "name": "black-friday-store.online"
      },
      {
        "id": "",
        "name": "beta-man.info"
      },
      {
        "id": "",
        "name": "bestshopu.online"
      },
      {
        "id": "",
        "name": "best85best.online"
      },
      {
        "id": "",
        "name": "becker624.online"
      },
      {
        "id": "",
        "name": "backback.info"
      },
      {
        "id": "",
        "name": "arrow-click.info"
      },
      {
        "id": "",
        "name": "arizonaclub.me"
      },
      {
        "id": "",
        "name": "anna-blog.info"
      },
      {
        "id": "",
        "name": "amg-car-ger.info"
      },
      {
        "id": "",
        "name": "alpha-man.info"
      },
      {
        "id": "",
        "name": "alison624.online"
      },
      {
        "id": "",
        "name": "all-for-city.info"
      },
      {
        "id": "",
        "name": "alex-mendez-fire.info"
      },
      {
        "id": "",
        "name": "albert-company.online"
      },
      {
        "id": "",
        "name": "adams-cooling.online"
      }
    ],
    "malware": [
      {
        "id": "e3b68667-79dc-4b4f-a6df-539f0f435d0b",
        "name": "PowerLess - S1012",
        "slug": "powerless-s1012"
      },
      {
        "id": "1351373d-d745-4e24-9911-3708a2fc3cd7",
        "name": "CharmPower - S0674",
        "slug": "charmpower-s0674"
      }
    ],
    "intrusion_sets": [
      {
        "id": "8d65bd58-ba62-48c0-9315-6516ba08bd8b",
        "name": "Educated Manticore",
        "slug": "educated-manticore"
      }
    ],
    "attack_patterns": [
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "29f7ff93-033b-4f8d-8691-5bcaa438c80f",
        "name": "T1592"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Iran, Islamic Republic of"
      },
      {
        "id": "",
        "name": "Israel"
      },
      {
        "id": "",
        "name": "Media"
      },
      {
        "id": "",
        "name": "Military"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "good-news.fashion"
      }
    ]
  },
  "external_refs": [
    "https://research.checkpoint.com/2025/iranian-educated-manticore-targets-leading-tech-academics/",
    "https://otx.alienvault.com/pulse/685db537f7a98c26737b6b3b"
  ]
}