Ongoing APT35 Phishing Campaign Uncovered: Iranian Group Impersonates Video Conferencing Services

The Stormshield Cyber Threat Intelligence team has uncovered new phishing infrastructure tied to APT35, also known as Mint Sandstorm, Charming Kitten, or Educated Manticore, with findings that extend a Check Point report and show the Iranian state‑linked group continuing video conferencing–themed phishing campaigns against high‑value targets in the Middle East and beyond.

During active threat hunting, two suspicious servers were identified; according to the report, “They share a lot of similarities with servers reported by Check Point on APT35. The servers are active and resolve multiple domains used for phishing purpose.” Using the SilentPush platform, researchers tracked distinctive HTML pages used across APT35 domains, notably a “four colored dots” loading animation, a tactic consistent with infrastructure seen earlier in 2025.

The investigation reveals two undocumented IPs: 84.200.193[.]20 (AS 214036 Ultahost, Inc.) linked to rohan63[.]xyz, and 79.132.131[.]184 (AS 39378 SERVINGA) hosting 49 domains, all using the .online TLD. Stormshield notes that most domains masquerade as video conferencing domains, with examples such as meet.go0gle[.]online or meet.video-connect[.]online, fitting a pattern going back to 2023 when Google Meet–style lures were weaponised to harvest credentials. The campaign is described as still ongoing and targeted at Israel.