Essential Information
Primary Target
CharmingKitten (Department 40)
IRGC-IO Counterintelligence Division (Unit 1500)
IRGC-IO Counterintelligence Division (Unit 1500)
Leader
Abbas Rahrovi
(aka Abbas Hosseini)
National ID: 4270844116
(aka Abbas Hosseini)
National ID: 4270844116
Geographic Focus
Middle East & Gulf Region
Turkey, UAE, Qatar, Afghanistan, Israel, Jordan, Kuwait, Saudi Arabia, Iran
Turkey, UAE, Qatar, Afghanistan, Israel, Jordan, Kuwait, Saudi Arabia, Iran
Evidence Types
Documents, Source Code, Infrastructure Data, Personnel IDs, Communications
Key Terminology
Organizational Terms
| Term | Full Name | Description |
|---|---|---|
| IRGC | Islamic Revolutionary Guard Corps | Iranian military organization |
| IRGC-IO | IRGC Intelligence Organization | Intelligence gathering unit of IRGC |
| Unit 1500 | Counterintelligence Division | Division under IRGC-IO |
| Department 40 | - | Cyber unit under Unit 1500, the specific CharmingKitten unit exposed |
| APT | Advanced Persistent Threat | Sophisticated, long-term cyber threat actor |
Technical Terms
| Term | Description |
|---|---|
| BellaCiao | .NET-based dropper malware with two variants for establishing persistent access |
| CYCLOPS | Malware tool used by Department 40 |
| TAGHEB System | Tool for infecting and obtaining access to Windows operating systems |
| Webshell | Script that provides remote command execution on compromised servers |
| C2 / C&C | Command and Control server for malware communication |
Quick Navigation
Overview Section
Getting Started
Getting Started
- Introduction - Start here for comprehensive overview
- Background - Organizational structure and operations
- Leadership - Key personnel and hierarchy
- Timeline - Episode releases and revelations
Operations
Operations
Detailed attack reports, target analysis, and operational activities across multiple countries
Personnel
Personnel
Individual operator profiles, national IDs, and organizational roles
Technical
Technical
Malware analysis, infrastructure documentation, and technical tools
Evidence
Evidence
Primary source documents, reports, and materials from Department 40’s internal network
Key Personnel Quick Reference
Leadership & Management
| Name | National ID | Role | Status |
|---|---|---|---|
| Abbas Rahrovi (Abbas Hosseini) | 4270844116 | Department Head | Active |
| Mohammad Najafloo | 4270878835 | Infrastructure Manager | Former |
| Mohammaderfan Hamidiaref | 0023199709 | Infrastructure Manager | Current |
| Manoochehr Vosoughi Niri | - | Front Company Director | Active |
Operators
| Name | National ID | Team | Role |
|---|---|---|---|
| Vahid Molawi | 0323217087 | Karaj Team | Attacker |
More personnel identities are being released in ongoing episodes. Check individual episode pages for the latest information.
Target Countries at a Glance
Primary Targets
- Turkey: Foreign Ministry and government entities
- UAE: Government and security employees (AMEEN ALKHALIJ recruitment)
- Israel: Extensive intelligence gathering and cyber operations
- Jordan: Government entities, civilian companies, media
- Iran: Regime opponents within country and abroad
Additional Targets
- Qatar, Afghanistan, Kuwait, Saudi Arabia
Evidence Categories
1. Internal Documents
- Attack reports on government and civilian entities
- Daily work reports from department employees
- Translation documents
- Training materials
2. Source Code & Tools
- BellaCiao malware complete source code
- Python & Webshells Framework
- Custom PowerShell scripts
- TAGHEB system details
3. Infrastructure Data
- Unified infrastructure Excel sheets
- Server credentials and login information
- Procurement identities
- Attack server details
4. Communications
- Isabelle chat network logs
- 3CX communications
- Output Messenger files
- Signal messages
5. Personnel Information
- Employee photos
- National identification numbers
- Work hours reports
- Organizational roles
Malware Quick Reference
BellaCiao
BellaCiao Technical Details
BellaCiao Technical Details
Type: .NET-based dropperVariants:
-
Variant 1: Drops a C# webshell enabling:
- File upload
- File download
- Command execution
-
Variant 2: Drops a PowerShell script that:
- Establishes reverse proxy using Plink (PuTTY suite)
- Executes customized PowerShell webserver
Other Tools
- CYCLOPS: Malware tool linked to Department 40 servers
- TAGHEB System: Windows infection and access tool
- Python & Webshells Framework: Custom command management interface
Front Companies
| Company Name | Farsi Name | Director | Purpose |
|---|---|---|---|
| JARF/ZHARF ANDISHAN TAFACOR SEFID | ژرف انديشان تفكر سفيد | Manoochehr Vosoughi Niri | Cover company for operations |
| AMEEN ALKHALIJ | - | - | UAE recruitment website |
Episode Structure
How to Verify Information
Linking Public Analysis to Department 40
-
BellaCiao Connection:
- Compare BitDefender analysis with exposed source code
- Match servers in infrastructure sheets to known C2 servers
-
CYCLOPS Connection:
- Analyze servers listed in Excel sheets
- Cross-reference with public threat intelligence
-
Infrastructure Correlation:
- Review procurement identities
- Match server credentials to known CharmingKitten infrastructure
Key Takeaways
Who
Department 40 under IRGC-IO Unit 1500, led by Abbas Rahrovi
What
Advanced persistent threat conducting cyber espionage and attacks
Where
Middle East and Gulf region: Turkey, UAE, Qatar, Afghanistan, Israel, Jordan, Kuwait, Saudi Arabia, Iran
Why
Counterintelligence operations, regime opponent tracking, terrorist activity promotion
Important Notes
CharmingKitten Terminology: In the cyber community, “CharmingKitten” is often used generally for IRGC-IO activities. This exposure specifically focuses on Department 40 under Unit 1500.
Contact Information
For further questions: [email protected]Next Steps
- Read the full Introduction for comprehensive context
- Review Leadership for detailed personnel information
- Check Timeline for episode release schedule
- Explore specific episodes for detailed evidence and analysis