Key Personnel

​

Overview

This page documents the key personnel identified as members of the CharmingKitten APT operating under IRGC-IO’s Counterintelligence Division (Unit 1500), Department 40.

​

Leadership

​

Abbas Rahrovi (Abbas Hosseini)

Profile: Abbas Rahrovi is the IRGC official heading the CharmingKitten APT operations. He has established several front companies in recent years through which he manages the APT. Activities:

• Directed attacks against dozens of targets
• Managed campaign activity and assets
• Coordinated malicious activity against international targets
• Operated as a “shadow man” until exposure

Target Focus:

• Telecommunications companies
• Aviation companies
• Intelligence organizations
• Countries in Middle East and Gulf region (Turkey, UAE, Qatar, Afghanistan, Israel, Jordan)

​

Operations Personnel

​

Key Operators Summary

​

Detailed Personnel Profiles

​

Vahid Molawi

National ID: 0323217087 Team: Karaj team Role: Attacker Evidence:

• Mentioned in hours reports from Episode 1
• Daily work reports documented his activities

​

MOHAMMAD NAJAFLOO

National ID: 4270878835 Role: Former Senior Infrastructure Manager Responsibilities:

• Maintained infrastructure Excel sheets for years
• Documented server procurement identities
• Managed server login credentials
• Tracked attack servers and file storage servers

Infrastructure Documentation: Najafloo was responsible for maintaining comprehensive records of:

• All operational servers
• Procurement identities used to acquire infrastructure
• Login credentials for servers on the internal network
• Details of attack servers (e.g., Tunnel servers)
• File storage and extraction systems

​

MOHAMMADERFAN HAMIDIAREF

National ID: 0023199709 Role: Current Infrastructure Manager Background:

• Took over infrastructure management role after NAJAFLOO’s departure
• Continued maintaining the infrastructure Excel sheets
• Manages operational server documentation

Responsibilities:

• Server infrastructure management
• Credential management
• Infrastructure documentation
• Operational systems access

​

MANOOCHEHR VOSOUGHI NIRI

Persian Name: منوچهر وثوقی نیری Role: IRGC-IO Official / Company Director Activities:

• Serves as director of front company JARF/ZHARF ANDISHAN TAFACOR SEFID
• Signs official documents for the cover company
• IRGC-IO official managing cover operations

Evidence:

• Document 5e98006a2cf1c15a164279558eed4a15018e34a0_بسمه تعالی
• Signature on company documents

​

MOHAMMAD ERFAN HAMIDI AREF

Persian Name: محمد عرفان حمیدی عارف Role: APT Employee Connection:

• Listed as employee in front company documentation
• Associated with JARF/ZHARF ANDISHAN TAFACOR SEFID
• Named in official documents signed by MANOOCHEHR VOSOUGHI NIRI

​

Team Structure

​

Karaj Team

Identified member:

• Vahid Molawi (0323217087) - Attacker role

Documentation:

• Daily work reports
• Hours reports
• Attack reports

​

Additional Teams

Documentation indicates multiple teams:

• MJD (Referenced in daily reports)
• HSN2 (Referenced in report structures)

​

Evidence Documentation

​

Internal Records

Personnel activities documented through: Daily Work Reports:

• MJD_Monthly-Reps_Mehr_1403 series
• Daily reports from 1403-06-25 through 1403-07-15
• Hours tracking and activity logs

Attack Reports:

• Monthly performance reports (بهمن ماه)
• Target-specific operation reports
• Technical exploitation reports (e.g., CVE-2024-1709)

Infrastructure Records:

• Excel sheets with server details
• Service procurement records
• Payment tracking (including BTC payments)

​

Communication Platforms

Personnel used internal communication systems:

• Issabelle
• 3CX
• Output Messenger
• Signal

​

Operational Security Failures

The exposure of these personnel resulted from:

1. Network Breach: Complete compromise of Department 40’s internal network
2. Documentation Leaks: Excel sheets, reports, and internal documents
3. Communication Logs: Chat logs from internal platforms
4. Photo Evidence: Employee photos from internal network

These individuals believed they were operating under IRGC protection but are now publicly identified as agents of the IRGC Intelligence Organization.