Threat actor
APT35
Iran
Tracked by CyberSIXT since 30 Sep 2025
- Articles · all time
- 6
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
6 articles from 1 outlet since 30 Sep 2025; the latest 125 days ago.
- Article
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 22 Jun · 23:40 UTC | dti.domaintools.com | Leaked files show APT35 runs like a government department |
| Tue 16 Dec 2025 · 21:25 UTC | dti.domaintools.com | The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operation |
| Thu 27 Nov 2025 · 00:51 UTC | SecurityOnline | UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror Unit |
| Wed 8 Oct 2025 · 09:55 UTC | GBHackers | APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked Group |
| Tue 30 Sep 2025 · 08:55 UTC | GBHackers | APT35 Hackers Targeting Government and Military to Steal Login Credentials |
| Tue 30 Sep 2025 · 01:45 UTC | SecurityOnline | Ongoing APT35 Phishing Campaign Uncovered: Iranian Group Impersonates Video Conferencing Services |
Names and sources
- APT35
- Named by CyberSIXT coverage
- APT35
- Named by Malpedia · apt35
- Agent Serpens
- Named by Malpedia · apt35
- COBALT MIRAGE
- Named by Malpedia · apt35
- Charming Kitten
- Named by Malpedia · apt35
- G0059
- Named by Malpedia · apt35
- Magic Hound
- Named by Malpedia · apt35
- Mint Sandstorm
- Named by Malpedia · apt35
All 33 names
- Newscaster
- Named by Malpedia · apt35
- Newscaster Team
- Named by Malpedia · apt35
- Parastoo
- Named by Malpedia · apt35
- Phosphorus
- Named by Malpedia · apt35
- RICH ION
- Named by Malpedia · apt35
- TunnelVision
- Named by Malpedia · apt35
- APT35
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- Agent Serpens
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- COBALT MIRAGE
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- G0059
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- Magic Hound
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- Mint Sandstorm
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- Newscaster Team
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- Phosphorus
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- RICH ION
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- TunnelVision
- Named by MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e
- APT35
- Named by MITRE ATT&CK® · G0059
- COBALT ILLUSION
- Named by MITRE ATT&CK® · G0059
- Charming Kitten
- Named by MITRE ATT&CK® · G0059
- ITG18
- Named by MITRE ATT&CK® · G0059
- Magic Hound
- Named by MITRE ATT&CK® · G0059
- Mint Sandstorm
- Named by MITRE ATT&CK® · G0059
- Newscaster
- Named by MITRE ATT&CK® · G0059
- Phosphorus
- Named by MITRE ATT&CK® · G0059
- TA453
- Named by MITRE ATT&CK® · G0059
Attributed facts
- origin
- Iran (MISP Galaxy · b8967b3c-3bc9-11e8-8701-8b1ead8c099e)
Malware and tools
Mimikatz (MITRE ATT&CK® · G0059) PsExec (MITRE ATT&CK® · G0059) Net (MITRE ATT&CK® · G0059) Systeminfo (MITRE ATT&CK® · G0059) Ping (MITRE ATT&CK® · G0059) ipconfig (MITRE ATT&CK® · G0059) netsh (MITRE ATT&CK® · G0059) DownPaper (MITRE ATT&CK® · G0059) Pupy (MITRE ATT&CK® · G0059) Impacket (MITRE ATT&CK® · G0059) CharmPower (MITRE ATT&CK® · G0059) PowerLess (MITRE ATT&CK® · G0059) FRP (MITRE ATT&CK® · G0059) Drokbk (Malpedia · apt35) pupy (Malpedia · apt35) SysKit (Malpedia · apt35)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0059
Stealth
Credential Access
- T1003.001
- LSASS Memory
Discovery
Lateral Movement
- T1021.001
- Remote Desktop Protocol
Collection
- T1005
- Data from Local System
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Leaked files show APT35 runs like a government departmentdti.domaintools.com
- The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operationdti.domaintools.com
- UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror UnitSecurityOnline
- APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked GroupGBHackers
- APT35 Hackers Targeting Government and Military to Steal Login CredentialsGBHackers
- Ongoing APT35 Phishing Campaign Uncovered: Iranian Group Impersonates Video Conferencing ServicesSecurityOnline · first in our coverage