The IRGC-linked APT35, also known as Charming Kitten, has been extensively analyzed revealing its sophisticated structure and diverse toolkit. This Iranian threat actor group is known for its cyber espionage campaigns targeting government, military, and private sector entities worldwide. APT35 employs a variety of malware and custom tools to conduct phishing, credential harvesting, and network infiltration. Recent investigations have uncovered new malware variants and updated attack techniques that enhance their operational capabilities. The group’s infrastructure includes command and control servers, phishing domains, and malware delivery mechanisms that are continuously evolving to evade detection. Understanding APT35’s tactics, techniques, and procedures (TTPs) is crucial for organizations to defend against their persistent threats. This article delves into the detailed architecture of APT35’s operations, highlighting key malware families used, notable attack campaigns, and mitigation strategies. Cybersecurity professionals must stay informed about APT35’s evolving threat landscape to implement effective security measures and protect sensitive information from this advanced persistent threat.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 09 Oct 2025 06:05:14 +0000