Iranian APT’s new data extraction tool Hyperscrape

Threat Level

Actor Report

For a detailed threat advisory, download the pdf file here

Summary

Charming Kitten, an Iranian government-backed threat group, has been employing a new data extraction tool, HYPERSCAPE. It has been used to retrieve data from Microsoft Outlook, Yahoo, and Gmail accounts. The tool is still being actively developed, and the most recent sample is from 2020.