Threat actor
APT35
Iran
Tracked by CyberSIXT since 30 Sep 2025
- Articlesall time
- 6
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 2
6 articles from 1 outlet since 30 Sep 2025; the latest 125 days ago.
- Article
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 22 Jun · 23:40 UTC | dti.domaintools.com | Leaked files show APT35 runs like a government department |
| Tue 16 Dec 2025 · 21:25 UTC | dti.domaintools.com | The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operation |
| Thu 27 Nov 2025 · 00:51 UTC | SecurityOnline | UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror Unit |
| Wed 8 Oct 2025 · 09:55 UTC | GBHackers | APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked Group |
| Tue 30 Sep 2025 · 08:55 UTC | GBHackers | APT35 Hackers Targeting Government and Military to Steal Login Credentials |
| Tue 30 Sep 2025 · 01:45 UTC | SecurityOnline | Ongoing APT35 Phishing Campaign Uncovered: Iranian Group Impersonates Video Conferencing Services |
Names and sources
16 names- APT35
- CyberSIXT coverage, Malpedia, MISP Galaxy, MITRE ATT&CK®
- Agent Serpens
- Malpedia, MISP Galaxy
- COBALT MIRAGE
- Malpedia, MISP Galaxy
- Charming Kitten
- Malpedia, MITRE ATT&CK®
- G0059
- Malpedia, MISP Galaxy
- Magic Hound
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- Mint Sandstorm
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- Newscaster
- Malpedia, MITRE ATT&CK®
8 more names
- Newscaster Team
- Malpedia, MISP Galaxy
- Parastoo
- Malpedia
- Phosphorus
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- RICH ION
- Malpedia, MISP Galaxy
- TunnelVision
- Malpedia, MISP Galaxy
- COBALT ILLUSION
- MITRE ATT&CK®
- ITG18
- MITRE ATT&CK®
- TA453
- MITRE ATT&CK®
Attributed facts
- Origin
Iran MISP Galaxy
Malware and tools
MITRE ATT&CK® · G0059 13
MITRE ATT&CK® techniques
78 techniques · 5 tacticsFrom MITRE ATT&CK® · G0059 · showing 12 of 78
Stealth 4
Credential Access 1
- T1003.001
- LSASS Memory
Discovery 5
Lateral Movement 1
- T1021.001
- Remote Desktop Protocol
Collection 1
- T1005
- Data from Local System
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Leaked files show APT35 runs like a government departmentdti.domaintools.com
- The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operationdti.domaintools.com
- UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror UnitSecurityOnline
- APT35: Inside the Structure, Toolset, and Espionage Operations of an IRGC-Linked GroupGBHackers
- APT35 Hackers Targeting Government and Military to Steal Login CredentialsGBHackers
- Ongoing APT35 Phishing Campaign Uncovered: Iranian Group Impersonates Video Conferencing ServicesSecurityOnline · first in our coverage