Newscaster

APT35, also known as Newscaster Team, is an Iranian government-sponsored cyber espionage group that conducts extensive operations to gather strategic intelligence. The group, which has been active since at least 2014, has been linked to a series of advanced persistent threat (APT) campaigns targeting various entities globally. Known by multiple names such as Charming Kitten, Phosphorus, Ajax Security Team, and TA453, the group has recently been dubbed Mint Sandstorm in Microsoft's updated threat actor naming taxonomy. The group has employed sophisticated tactics and tools in its operations. Volexity, a security firm, observed the group using an updated version of the PowerShell backdoor POWERSTAR in a spear-phishing campaign. ESET researchers have also reported a series of attacks conducted by the group, targeting entities in Brazil, Israel, and the United Arab Emirates. Notably, these attacks involve the use of targeted messages to victims with the aim of stealing login credential information. Newscaster's activities are primarily aimed at intelligence gathering, with potential applications ranging from supporting the development of weapon systems to gaining insight into U.S. military disposition or negotiations between Iran and the U.S. This was highlighted in a 2014 report by iSight, which described an elaborate net-based spying campaign organized by Iranian hackers using social media. Given the ongoing nature of Newscaster's activities and their potential implications for global security, it is crucial to continue monitoring and combating this threat actor.