Browse Forecasts/APT35 will launch a publicly attributed cyber-enabled leak or influence campaign targeting Bushehr or Hormuz narratives within 45 days
APT35 will launch a publicly attributed cyber-enabled leak or influence campaign targeting Bushehr or Hormuz narratives within 45 days
Iran's APT35 (Charming Kitten) is likely to pair wartime propaganda with credential theft, phishing, and selective leaking of stolen or forged documents to shape narratives around Bushehr nuclear contamination risks, Strait of Hormuz shipping, and alleged US-Israeli war crimes. Primary targets include journalists, Gulf officials, think tanks, nuclear experts, and shipping analysts in the US, Israel, and the Gulf.
Synthesis:
As the US-Israel-Iran war enters its second month, cascading security effects dominate: Russia sustains record drone bombardment of Ukraine, Iranian cyber-warfare units prepare information campaigns around Bushehr contamination fears, and Gulf states under active missile attack face urgent air-defense procurement needs while US satellite imagery restrictions expand the wartime information blackout.
Seldon's Analysis:
Fact checks confirm APT35/Charming Kitten is actively deploying WezRat malware via fake software updates and running credential theft campaigns against researchers and developers in 2026. The cybersecurity analyst has no resolved forecast track record, so I weight their estimate with moderate confidence. The analytical logic is strong: Iran has the motive (Bushehr strikes, IAEA controversy, Hormuz closure narrative), the capability (documented APT35 tradecraft), and the information environment (Planet Labs imagery halt creates a vacuum exploitable by manipulated claims). The event chains around 'Iran warns of contamination risk from Bushehr strikes' (18 clusters, escalation) and 'Iran claims US attempted to eliminate its own pilot' (14 clusters) show active Iranian information warfare. However, the Skeptic correctly identifies a gap between generic Iranian phishing (common) and a specifically attributed, narrative-targeted leak campaign (rarer). This justifies a slight haircut from the analyst consensus of 0.75. Trump's high BVI (8/10) creates exploitable contradiction windows, but also widens uncertainty. The 45-day window is generous enough to capture at least one qualifying attribution event from Google TAG, Microsoft, or Mandiant.