The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operation

The APT35 Dump Episode 4 lays bare the bureaucratic machine behind Iran’s cyber operations, showing spreadsheets that log hosting providers, invoices, crypto receipts, and service IDs rather than spectacular exploits. The report describes a ledger-driven workflow where one-time ProtonMail identities are created for single procurement events, domains are clustered and private WHOIS is used, and multiple low-cost VPS purchases are paid for with crypto through Cryptomus.

It ties Moses Staff to Charming Kitten, arguing that the same administrative machinery supports both the group’s public leaks and its long-running credential-phishing operations, with invoices and hosting dashboards forming a continuous evidentiary trail. The leaked files detail roughly 170 populated rows on a service sheet, more than 50 ProtonMail identities, and around 80 cleartext credential pairs, plus a pattern of micro-payments averaging €12–€18 routed via European resellers.

It also notes a central Bitcoin wallet that transacted 90 times before being emptied, illustrating how the operation funds itself through a durable, ledger-centric economy. According to the article, APT35’s operators follow a templated, bureaucratic playbook that prioritises procurement, renewal cycles, and administrative discipline as the backbone of Tehran’s cyber theatre.