Overview
The CharmingKitten Department 40 exposure is released in episodes every few days, with each episode containing new evidence, personnel information, and operational details. This timeline documents the key revelations from each episode.New episodes are released regularly. This timeline is continuously updated as new information becomes available.
Episode Releases
Episode 1: Initial Exposure
Episode 1 - The Beginning
Episode 1 - The Beginning
Release Theme: Initial exposure of CharmingKitten’s Department 40
Key Revelations
Leadership Identified:- Abbas Rahrovi (aka Abbas Hosseini, National ID: 4270844116)
- IRGC official managing Department 40 through front companies
- Directed attacks against dozens of targets over the years
- APT affiliated with Counterintelligence Division (Unit 1500) of IRGC-IO
- Known publicly as CharmingKitten
- Telecommunications companies
- Aviation companies
- Intelligence organizations
- Middle East and Gulf region
- Turkey, UAE, Qatar, Afghanistan, Israel, Jordan
- Iranian regime opponents (within Iran and abroad)
- Official documents from APT’s internal network
- Employee photos
- Attack reports
- Translation documents
- Files from internal chat networks (Isabelle, 3CX, Output Messenger)
“These individuals believed they were operating under the protective cover of the IRGC — today, they will be recognized worldwide as agents of the IRGC.”
Episode 2: Clarifications and First Operator
Episode 2 - Organizational Structure
Episode 2 - Organizational Structure
Release Theme: Structural clarifications and expanded attack documentation
Important Clarifications
IRGC-IO Structure Explained:- IRGC-IO is the intelligence gathering unit of IRGC
- Multiple divisions under IRGC-IO, each with cyber units
- CharmingKitten terminology used generally in cyber community
- This exposure specifically focuses on Counterintelligence Division (Unit 1500), Department 40
- Division uses Department 40 for counterintelligence needs
- Cyberattacks against Iranian citizens and exiles (“regime opponents”)
- Operations against European, Israeli, and Arab citizens
- All activities support terrorist activities and counterintelligence
New Evidence Released
Attack Reports:- Government entities in Jordan, Iran, Kuwait, Saudi Arabia, Turkey
- Civilian companies across multiple countries
- Media organizations
- Daily work reports of department employees
- Department server logs
- AMEEN ALKHALIJ server: Website set up to recruit former government and security employees from UAE
First Operator Identity
Vahid Molawi:- National ID: 0323217087
- Team: Karaj team
- Evidence: Hours report from Episode 1
- Role: Attacker
Commitment
“Let’s eliminate this APT once and for all!”
Episode 3: Source Code and Front Companies
Episode 3 - Malware Exposure
Episode 3 - Malware Exposure
Release Theme: Malware source code and front company operations
Major Technical Release
BellaCiao Malware Source Code:- Complete source code exposed
- Previously analyzed by BitDefender
- Links public analysis to Department 40 operations
-
.NET-based dropper with two variants:
- Variant 1: C# webshell (file upload/download, command execution)
- Variant 2: PowerShell script (reverse proxy via Plink, customized webserver)
- Example Attack: Turkish Foreign Ministry using BellaCiao
- Python & Webshells Framework:
- Python scripts as command management interface (attacker side)
- Webshells deployed on victim systems (execute commands, relay output)
- TAGHEB System: Windows infection and access tool
- Testing malware against AV products:
- Microsoft Defender
- Kaspersky
- Avira
- ESET
- Others
Intelligence Revelations
Document 682089f4bd1c3e6636e15b89e967bf4fa9d7861a_#78TPDD:- Iranian directive in campaign activity
- Iranian involvement in cyber attacks
- Public influence platforms: MOSESS STAFF connection
- Name: JARF/ZHARF ANDISHAN TAFACOR SEFID (ژرف انديشان تفكر سفيد)
- Document 5e98006a2cf1c15a164279558eed4a15018e34a0_بسمه تعالی
- Signatories:
- Manoochehr Vosoughi Niri (منوچهر وثوقی نیری) - Company director and IRGC-IO official
- Mohammad Erfan Hamidi Aref (محمد عرفان حمیدی عارفا) - Employee
Additional Materials
- Training programs
- Technical espionage details
- Intelligence reports on Israeli entities
Leadership Assessment
“Abbas Rahrovi is leading the campaign’s activity, assets, and malicious activity against international targets. Abbas is a ‘shadow man’, but the campaign he has set up has now been exposed, and is very embarrassing for the Iranian leadership.”
Episode 4: Infrastructure and Credentials
Episode 4 - Infrastructure Exposure
Episode 4 - Infrastructure Exposure
Release Theme: Complete infrastructure documentation and server credentials
Critical Infrastructure Exposure
Unified Infrastructure Excel Sheet:- Documents all Department 40 servers
- Comprehensive infrastructure mapping
- Years of operational data
- Procurement identities
- Server login credentials
- Attack server details (e.g., Tunnel servers)
- File storage servers
- Other operational infrastructure
Key Personnel in Infrastructure Management
Mohammad Najafloo:- National ID: 4270878835
- Role: Former senior employee
- Responsibility: Maintained Excel sheets for years
- Status: Departed from position
- National ID: 0023199709
- Role: Current infrastructure manager
- Responsibility: Took over after Najafloo’s departure, continues managing infrastructure
Verification of CharmingKitten Connection
Proof Method:- Analyze servers listed in Excel sheet
- Servers used by BellaCiao malware
- Servers used by CYCLOPS malware
- Cross-reference with public threat intelligence
Additional Sensitive Information
Internal Network Credentials:- Passwords for internal network servers
- Access to internal communication platforms:
- Isabelle
- 3CX
- Signal
- File extraction systems access
- Storage server credentials
Additional Files Included
- Materials from Dubai Police: Data obtained by Department 40 from Dubai Police
- Phishing Guide: Department 40’s internal phishing methodology
- Penetration Report: Medical entity compromise documentation
Call to Community
“We encourage you to analyze the provided files and share your insights. Your findings will help further expose the group’s operations and infrastructure.”
Timeline Summary
Episode 1
Initial Exposure
Leadership identified (Abbas Rahrovi), organizational context, target categories, evidence types introduced
Leadership identified (Abbas Rahrovi), organizational context, target categories, evidence types introduced
Episode 2
Structure & Operations
IRGC-IO clarification, first operator identity (Vahid Molawi), expanded attack reports, infrastructure exposure (AMEEN ALKHALIJ)
IRGC-IO clarification, first operator identity (Vahid Molawi), expanded attack reports, infrastructure exposure (AMEEN ALKHALIJ)
Episode 3
Source Code & Front Companies
BellaCiao complete source code, front company exposure (JARF/ZHARF ANDISHAN TAFACOR SEFID), MOSESS STAFF connection
BellaCiao complete source code, front company exposure (JARF/ZHARF ANDISHAN TAFACOR SEFID), MOSESS STAFF connection
Episode 4
Infrastructure & Credentials
Unified Excel sheets, server credentials, infrastructure personnel (Najafloo, Hamidiaref), Dubai Police materials
Unified Excel sheets, server credentials, infrastructure personnel (Najafloo, Hamidiaref), Dubai Police materials
Cumulative Personnel Exposed
| Episode | Name | National ID | Role |
|---|---|---|---|
| 1 | Abbas Rahrovi (Abbas Hosseini) | 4270844116 | Department Head |
| 2 | Vahid Molawi | 0323217087 | Karaj Team Attacker |
| 3 | Manoochehr Vosoughi Niri | - | Front Company Director, IRGC-IO Official |
| 3 | Mohammad Erfan Hamidi Aref | 0023199709 | Front Company Employee |
| 4 | Mohammad Najafloo | 4270878835 | Former Infrastructure Manager |
| 4 | Mohammaderfan Hamidiaref | 0023199709 | Current Infrastructure Manager |
Mohammad Erfan Hamidi Aref and Mohammaderfan Hamidiaref appear to be the same person with different name transliterations.
Evidence Categories by Episode
Documents & Reports
- Episode 1: Initial attack reports, translation documents, employee photos
- Episode 2: Daily work reports, expanded attack reports across Jordan, Iran, Kuwait, Saudi Arabia, Turkey
- Episode 3: Training programs, technical espionage details, intelligence reports on Israel
- Episode 4: Phishing guide, penetration reports, materials from Dubai Police
Source Code & Technical
- Episode 3: BellaCiao complete source code, Python & Webshells Framework, TAGHEB system
- Episode 4: Infrastructure documentation, server credentials
Infrastructure
- Episode 2: AMEEN ALKHALIJ server and recruitment website
- Episode 4: Unified infrastructure Excel sheets, all server credentials and details
Communications
- Episode 1: Isabelle, 3CX, Output Messenger files
- Episode 4: Additional Signal communications access
Organizational
- Episode 3: Front company documentation (JARF/ZHARF ANDISHAN TAFACOR SEFID)
- Episode 3: MOSESS STAFF connection
Key Themes Across Episodes
Progressive Disclosure
Each episode builds on previous revelations, adding depth and connecting evidence
Multi-faceted Evidence
Documents, source code, infrastructure, personnel, and communications all exposed
Attribution Proof
Linking public threat intelligence to internal Department 40 operations
Ongoing Exposure
Regular releases every few days with commitment to expose more personnel and operations
Impact and Significance
For Threat Intelligence Community
- Direct link between publicly known CharmingKitten operations and Department 40
- Source code enables better detection and defense
- Infrastructure documentation enables tracking and blocking
For Attribution
- Specific personnel identified with national IDs
- Organizational structure mapped
- Front companies exposed
- Leadership directly named
For Iranian Leadership
- Described as “very embarrassing”
- Removes protective cover from operations
- Exposes IRGC-IO involvement in terrorist activities
- International recognition of agents
Future Episodes
Expected Content in Future Episodes
- More operator identities and national IDs
- Additional front company documentation
- Expanded attack reports and target details
- More malware source code and tools
- Personal information about department personnel
- Additional infrastructure and communications data
Stay Updated
For the latest episode information and new revelations:- Check this timeline regularly for updates
- Review individual episode pages for detailed analysis
- Monitor personnel directory for new identities
- Contact: [email protected] for questions
This timeline is a living document and will be updated as new episodes are released. The exposure aims to eliminate Department 40’s operations by removing their protective cover and exposing their activities to the world.