Hamid-K

Comprehensive Threat Intelligence Report: Charming Kitten

DFIR and CTI Analysis Date: 2025-10-29

1. Executive Summary

This report provides a comprehensive analysis of the Tactics, Techniques, and Procedures (TTPs), operational tradecraft, and targeting patterns of the threat actor group known as "Charming Kitten." The analysis is based on a leaked dataset of the group's internal documents, logs, and operational reports. The findings indicate a sophisticated and well-organized actor with a clear focus on espionage and disruptive attacks.

A groundbreaking finding from the Episode 4 leak is the direct link between Charming Kitten and the previously distinct threat groups known as "Moses-Staff" and "Qassam". Analysis of the group's internal infrastructure and payment records reveals that these are not separate entities, but rather pseudo-names or campaigns operated by Charming Kitten. This attribution, which has not been publicly documented before, is a critical development in understa

Hamid-K

#!/usr/bin/env python3
import argparse
import json
import math
import subprocess
import sys


def run_ffprobe(path):
    cmd = [

Hamid-K

#!/usr/bin/env python3
"""
Scan and harden package-manager release-age gates.

This script is intentionally self-contained: it uses only the Python standard
library and writes only user-level config files. It covers the package-manager
ecosystems inventoried by Perplexity Bumblebee plus additional common language
package managers.

Native age gates currently handled in harden mode: