A notorious threat organization has begun shifting their social engineering and overall tactics, becoming more aggressive towards victims of their phishing campaigns. The group, tracked as TA453 (bearing similar TTPs as APT42, Charming Kitten, PHOSPHORUS), often launches extensive social engineering operations targeting journalists, human rights activists, academics, diplomats, and several others. Historically, TA453 threat actors often structured their attacks around the victim they were targeting, establishing a bond between threat actor and victim to increase the chance of engagement and successful malware delivery. Some subgroups of TA453 would converse with the victim for days to weeks at a time, eventually delivering a malicious link with the intent of harvesting the victim’s credentials in several fashions. Other subgroups would act like most social engineering-driven threat groups and outright send the malicious link and hope the victim clicks on the embedded content. In recent campaigns, TA453 actors have shifted to becoming more aggressive against their victims. After compromising multiple email accounts including several high-ranking military officials, threat actors spear-phished a single victim with a harsh email. After translation from Hebrew, the email reads “I’m sure you remember what I told you. Every email you get from your friends may be me and not someone who it claims. We follow you like your shadow, in [REDACTED]… Take care of yourself“. With a dramatic shift in tactics from TA453, researchers indicate this could be an intimidation tactic formed between TA453 and hostile Iranian state-aligned operations. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.