A massive leak has revealed the identities, infrastructure, tools, and operations of Iran’s Revolutionary Guards’ top cyber unit, Charming Kitten, exposing their long-term efforts to infiltrate Israel’s military, defense industries, critical infrastructure, and beyond, according to an in-depth analysis by Haaretz. The documents show that the group systematically conducted espionage, influence campaigns, and cyberattacks on strategic targets, including the Israel Airports Authority, Rafael arms manufacturer, and Israel’s Transportation Ministry, highlighting the sophisticated and global reach of Iran’s cyber warfare capabilities.
The leak, published anonymously on GitHub by an account calling itself Kitten Busters, contains comprehensive information on the hackers, their commanders, activity logs, source code for malware and spyware, and internal communications. Haaretz’s examination of the documents revealed that the unit operates as a fully militarized branch of the Revolutionary Guards, rather than a proxy or loosely affiliated hacker group. The unit’s formal name, Cyber Intelligence Group 1500, appears on official letterhead and includes a detailed chain of command. Soldiers maintain ranks and dog tags, submit regular reports to senior commanders, and operate under directives aimed at gathering intelligence and undermining adversaries.
According to the leak, the group employs a range of advanced cyber techniques, including phishing campaigns, spyware deployment, malware insertion, and identity theft. The documents confirm repeated attempts to hack into Rafael’s internal email and project management systems, alongside efforts to access the Israel Airports Authority, Transportation Ministry, and Bezeq International. Screenshots and activity logs show that some attacks penetrated industrial control systems, including water management networks, highlighting vulnerabilities in outdated or poorly maintained infrastructure. Israeli firm Enersun confirmed that some systems had been remotely accessed in 2018 and 2019, though protections largely prevented critical damage.
Haaretz reports that the leak also exposes the use of global infrastructure and deceptive techniques, including fake Israeli identities with locally registered phone numbers and virtual private servers in Israel, which allowed the hackers to mask their activity and improve the credibility of phishing and social engineering attacks. The documents link Charming Kitten to other previously identified hacker groups, such as Moses Staff and Handala, showing these personas were used for propaganda, psychological operations, and disinformation campaigns against Israeli individuals, institutions, and businesses.
The revelations extend beyond Israel. The documents detail attempts to hack governmental and commercial targets in the Middle East and Europe, including Dubai police, the Jordanian government, Turkey’s Foreign Ministry, and Greek shipping companies. Haaretz notes that these operations align with Iran’s strategic interests, such as monitoring maritime traffic, evading sanctions, and gathering intelligence on regional adversaries.
Analysts emphasize that Charming Kitten is not merely a “state-supported” group but a fully integrated military entity carrying out operations as part of Iran’s broader strategic objectives. “This is a real military unit, not a hacker group receiving state support – literally state, not proxy,” said a senior Israeli researcher cited by Haaretz. The leak contains personal profiles of operatives, including team leaders, penetration testers, malware developers, spyware specialists, and media coordinators, demonstrating a highly organized and hierarchical structure.
The documents also reveal advanced technical capabilities. The group uses tools such as BellaCiao, a cellphone spyware developed by Iran, and manuals for operating Trojan horses designed to gain illicit access to systems. Screenshots of internal processes illustrate the systematic approach taken to compromise sensitive systems, including industrial, commercial, and governmental targets. A February 2024 report in the leak details the scanning of 256 Israeli VPN servers, with 29 identified as vulnerable, resulting in two successful penetrations, demonstrating the unit’s ongoing ability to exploit software weaknesses.
Haaretz also highlights the unit’s sophisticated cyber-influence campaigns. The leak shows coordination of media operations to maximize psychological impact, including hacks of security cameras, dissemination of private files, and exposure of sensitive documents online. The documents reveal attempts to recruit agents in Israel, conduct propaganda campaigns, and generate disinformation, all while disguising operations as independent cyberattacks or actions by smaller hacker collectives.
This unprecedented exposure provides an extraordinary window into Iran’s cyberwarfare infrastructure, demonstrating how a state-directed unit operates globally, targeting military, industrial, and governmental networks with precision. By combining intelligence gathering, operational hacking, and influence campaigns, Charming Kitten illustrates the evolving threat landscape facing Israel and other nations in the region, as reported by Haaretz.
Experts argue that the leak represents one of the largest disclosures of Iranian offensive cyber operations to date, showing the sophistication, scale, and strategic intent behind the Revolutionary Guards’ online activities. It underscores the growing challenge of defending against state-level cyber operations, particularly when attackers can exploit widely used technologies, manipulate identities, and orchestrate multi-layered campaigns spanning multiple countries.
