APT35

APT35, also known as the Newscaster Team, Charming Kitten, and Mint Sandstorm, is an Iranian government-sponsored cyber espionage group. The group focuses on long-term, resource-intensive operations to collect strategic intelligence. They primarily target sectors in the U.S., Western Europe, and the Middle East, including military, diplomatic, and government personnel, organizations in media, energy, defense industrial base, engineering, business services, and telecommunications sectors. APT35 has been involved in counterintelligence operations at the behest of the Islamic Revolutionary Guard Corps (IRGC), attacking international conferences such as the Munich Security Conference and Think20 Summit in Saudi Arabia. Between March 2021 and June 2022, APT35 compromised at least 34 companies with previously unknown Sponsor malware, targeting government and healthcare organizations, as well as firms in financial services, engineering, manufacturing, technology, law, telecommunications, and other industry sectors. The group typically uses spearphishing as its initial attack vector, often using lures related to healthcare, job postings, resumes, or password policies. It employs a variety of associated malware, including ASPXSHELLSV, BROKEYOLK, PUPYRAT, TUNNA, MANGOPUNCH, DRUBOT, and HOUSEBLEND. In November 2023, during Israel's ongoing war with Hamas, APT35 targeted Israel's technology, logistics, and transportation industries. This operation was part of a broader campaign by the threat actor, which is believed to be tied to the IRGC, an intelligence arm of Iran’s military. The group is recognized for its technically and operationally mature subgroups, one of which is Mint Sandstorm. These subgroups focus on stealing sensitive data from high-value targets, demonstrating the considerable threat posed by APT35.