APT35

APT35, also known as the Newscaster Team, Charming Kitten, and Mint Sandstorm, is an Iranian government-sponsored cyber espionage team. This threat actor conducts long-term, resource-intensive operations to collect strategic and tactical intelligence on behalf of the Islamic Revolutionary Guard Corps (IRGC), an intelligence arm of Iran's military. Their targets primarily include U.S., Western European, and Middle Eastern military, diplomatic, and government personnel, along with organizations in media, energy, defense industrial base, engineering, business services, and telecommunications sectors. APT35 has been involved in counterintelligence operations, including attacks against international conferences such as the Munich Security Conference and Think20 Summit in Saudi Arabia. The group typically relies on spearphishing to initially compromise an organization, often using lures related to healthcare, job postings, resumes, or password policies. They have been associated with various malware, including ASPXSHELLSV, BROKEYOLK, PUPYRAT, TUNNA, MANGOPUNCH, DRUBOT, and HOUSEBLEND. Notably, between March 2021 and June 2022, APT35 backdoored at least 34 companies with previously unknown Sponsor malware, targeting government and healthcare organizations, as well as firms in financial services, engineering, manufacturing, technology, law, telecommunications, and other industry sectors. APT35 has demonstrated technical and operational maturity, conducting reconnaissance and attacks under the guise of sanctioned companies like Najee Technology and Afkar System. The group overlaps with other threat actors identified by cybersecurity firms such as Google's Mandiant and Crowdstrike. Microsoft researchers have noted that APT35 used legitimate, yet compromised accounts to send phishing lures. The goal of these activities is to steal sensitive data from high-value targets, indicating a focus on both strategic information gathering and direct disruption.