Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

According to Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets, internal documents from APT35 (Charming Kitten) reveal a regimented, quota‑driven cyber operations unit operating inside a bureaucratic military chain of command, with monthly KPI reporting, supervisor reviews, and attendance logs confirming on‑premises coordination.

The leak details Exchange‑centred tradecraft (ProxyShell, Autodiscover, EWS) alongside Ivanti and VPN appliance exploitation, credential harvesting, HERV phishing, and sustained mailbox monitoring aimed at long‑term HUMINT collection across Turkey, Lebanon, Kuwait, Saudi Arabia, Korea, and domestic Iran.

It also describes a tightly scripted organisational structure under IRGC IO Unit 50 and a central Campaign Coordination Unit, with named leads such as Abbas Rahrovi and Vosoughi Niri, and teams including Engineer Kian and Team Kian, whose KPI‑driven workflow ties exploitation, persistence, and reporting into a single production line.

The report notes memory‑based credential theft (LSASS dumps), token replay, and OAuth abuse, plus webshells and C2 channels, all deployed through a centralised, bureaucratised workflow that maps to a state‑directed espionage objective. Observed infrastructure includes both Iranian internal hosts and international relays (e.g., 128.199.237[.]132; 212.175.168[.]58) used to stage, exfiltrate, and pivot across targets.

The material closes by emphasising the defensive priority to harden Exchange/OWA, patch Ivanti/F5, and pursue lawful HUMINT channels to disrupt the KPI‑driven attack cycle.