APT35 is an Iranian state-linked threat group associated with cyber espionage, phishing, credential theft, and targeting of sensitive organizations.
Search across headline titles and summaries.
Background for this topic.
APT35 is a cyber espionage group linked to Iranian state interests, specializing in targeted attacks against government, academic, and media organizations mainly in the Middle East, Europe, and the U.S. They use spear-phishing emails, credential harvesting, and custom malware to gain long-term access to sensitive networks for intelligence collection and influence operations.
Security teams should focus on defending against APT35’s social engineering tactics and their use of zero-day vulnerabilities to evade detection. Key defenses include enforcing multi-factor authentication, monitoring for unusual login behavior, and promptly applying security patches. Sharing threat intelligence on APT35’s indicators of compromise helps organizations identify and mitigate their stealthy intrusions more effectively.
Weekly headline count for the current query.
A nation-state threat actor known as 'Charming Kitten' (Phosphorus, TA453, APT35/42) has been observed deploying a previously unknown backdoor malware named 'Sponsor' against 34 companies around the globe. [...]
Security researchers observed a new campaign they attribute to the Charming Kitten APT group where hackers used new NokNok malware that targets macOS systems. [...]
State-sponsored Iranian hacking group Charming Kitten has been using a new tool to download email messages from targeted Gmail, Yahoo, and Microsoft Outlook accounts. [...]