APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked Group

According to CloudSEK’s TRIAD unit, Charming Kitten (APT35) is revealed as an IRGC-linked operation with a defined hierarchy: a Management cell at the top, a Sarrafi contractor handling cryptocurrency transactions and document forgery, and separate administrative and operational teams led by figures such as Mehdi Sharifi, Esmaeil Heydari, and Vahid Molavi who collectively log more than 160 hours of work each month.

The leak outlines a dedicated penetration team including Ali, a SQL injection specialist, and Mohammad, who automates web-exploitation tools to target Israeli sites, while HSN spearheads custom RAT development under the RTM Project for Active Directory domination.

The operation also covers large-scale infrastructure work with experts like Amir Hossein using RouterScan and RouterSploit to compromise GoAhead, TP-LINK and Cisco devices, and notes rapid exploitation like CVE-2024-1709 weaponised within 24 hours after disclosure across multiple regional targets.

Exfiltration targets span legal, academic, aviation, energy, financial and government sectors, including 74 GB of exfiltrated judgment archives and lawyer dossiers from Qistas, with persistence maintained via web shells, obfuscated DLL payloads, encrypted VeraCrypt containers and VM snapshots that bypass EDR solutions such as SentinelOne and Trend Micro.

The article, dated 8 October 2025, depicts APT35’s multi-year access, strategic breadth across six countries—Israel, Saudi Arabia, Turkey, Jordan, UAE and Azerbaijan—and a coordinated approach to supply-chain and data theft.