APT35
Iranian state-sponsored actor associated with the IRGC. Conducts long-term espionage and credential-phishing operations against journalists, dissidents, U.S. and Israeli government targets, and academic researchers working on Middle East policy. Known for elaborate social-engineering personas sustained over months.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
2 events- AdvisoryHigh2022-01-11·Check Point Research
APT35 weaponizes Log4Shell against unpatched targets
Check Point Research observed APT35 actively exploiting Log4Shell (CVE-2021-44228) within a week of public disclosure, deploying a modular PowerShell toolkit ('CharmPower') against vulnerable VMware Horizon and similar Java-stack targets.
log4shellcve-2021-44228powershell - IndictmentHigh2018-03-23·U.S. Department of Justice
DOJ indicts nine IRGC-affiliated actors for academic phishing
DOJ indicted nine Iranians associated with the Mabna Institute for a multi-year credential-phishing campaign against more than 300 universities worldwide, the U.S. Department of Labor, the FERC, and the United Nations — overlapping with APT35 / Charming Kitten activity.
indictmentcredential-phishingacademia
Indicators of compromise
2 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| Name | family · MischiefTut PowerShell reconnaissance backdoor named by Microsoft in the January 2024 Mint Sandstorm advisory; deployed post-intrusion alongside MediaPl to write recon output to documentLoger.txt and pull additional tools onto victim hosts at Middle East research organizations. | Oct 31, 2023 | Microsoft |
| SHA-256 | family · MediaPl MediaPl custom backdoor (MediaPl.dll) masquerading as Windows Media Player, attributed by Microsoft in January 2024 to a Mint Sandstorm subgroup (APT35 / Charming Kitten / Phosphorus) targeting Middle East affairs researchers at universities in BE, FR, IL, UK and US. Communicates with C2 via AES-CBC encrypted, Base64-encoded channels. | Oct 31, 2023 | Microsoft |
Related actors
shared ATT&CK techniques- KP · DPRKBlueNoroff1 shared technique
- RU · RussiaCOLDRIVER1 shared technique
References
cite this page
Threat Intel Tracker. (2026-05-19). APT35 — actor profile. Retrieved from https://threatintel.local/actors/apt35