APT35 Hackers Targeting Government and Military to Steal Login Credentials

Stormshield CTI researchers have identified two active phishing servers linked to APT35, revealing ongoing credential-stealing operations targeting government and military entities across the US, the Middle East, and Europe. In an active threat-hunting operation, Stormshield’s Cyber Threat Intelligence team found these servers mirroring footprints documented by Check Point, hosting pages designed to harvest login credentials from government, military, academic, and media organisations.

The investigation notes that APT35, also known as Mint Sandstorm, Charming Kitten, or Educated Manticore, is Iran‑linked and has been active since at least 2015, with video conferencing themes central to its phishing tactics since 2023, according to Google threat analysts, according to Check Point.

Identified infrastructure includes IPv4 addresses 45.143.166[.]230 and 195.66.213[.]132, with two additional hosts—84.200.193[.]20 (Ultahost, Inc.) and 79.132.131[.]184 (SERVINGA)—hosting multiple domains that largely resolve to online domains used as credential-phishing frontends. The latest domain registration noted was proof-video[.]online on 20 September 2025, with many other domains spoofing video-conferencing services such as meet.go0gle[.]online and meet.video-connect[.]online.

Defenders are urged to apply template fingerprinting, monitor subdomains prefixed by viliam., and search for invitation parameters in phishing URLs to detect and disrupt APT35’s credential-stealing campaign.