APT35 is a cyber espionage group. MITRE ATT&CK tracks it as Magic Hound and describes it as Iranian-sponsored. It is also called Charming Kitten, Phosphorus and Mint Sandstorm. The post says it has been active for more than a decade. It targets governments, academics, human rights NGOs and media organizations. It does this mainly through phishing. It also uses impersonation and fake log-in portals. The UK NCSC lists APT42 and Charming Kitten as names of one actor, TA453. MITRE ATT&CK tracks them as separate groups. Our APT42 threat group profile sets out where the sources differ.
Introduction
APT35 is one of Iran’s most persistent, adaptive, and visible state-backed cyber actors. The group has been given many names. They include Charming Kitten, Phosphorus, Mint Sandstorm, and COBALT MIRAGE. It has been active for more than a decade. The actor uses espionage, surveillance, and disinformation. These help it reach Iran’s strategic goals.
Campaigns tied to the actors show a steady interest in collecting intelligence for political ends. They also show interest in monitoring dissidents. Some activities yield geopolitical intelligence. All actors tied to the Iranian government often use this tactic. To illustrate, APT35 targets governments, academics, and media organizations to collect intelligence. It also targets non-governmental organizations concerned with human rights. Recently, APT35 has expanded its tactics. They now include AI-assisted disinformation. They also include exploiting vulnerabilities found in enterprise technologies.
Who Is APT35 and What Motivates It?
APT35 is directly tied to the Islamic Revolutionary Guards Corps (IRGC). The IRGC is an elite security and intelligence group.
- Active Since: At least 2011
- Motivation: Espionage, influence, and disruption aligned with Iran’s foreign policy goals, silencing dissent, and spreading propaganda
- Aliases: CharmingCypress, Group 83, TunnelVision, COBALT MIRAGE, TA455, Mint Sandstorm, Phosphorus, Smoke Sandstorm, NewsBeef, Charming Kitten, BOHRIUM, iKittens, Magic Hound, Newscaster, Newscaster Team, Parastoo, Yellow Dev13.
APT35 has many acronyms. This reflects the group’s longevity and the spectrum of operations seen by different security vendors.
Tactics, Techniques, and Procedures (TTPs)
Initial Access
APT35 is highly reliant on social engineering and phishing, including:
- Fake news and media websites.
- Impersonating journalists, academics or NGOs.
- Sending malicious links via e-mail, LinkedIn or WhatsApp.
These tactics often lure the targets into fake log-in portals. The portals are designed to capture their credentials.
- Social engineeringFake news sites, impersonated journalists, academics or NGOs, links by e-mail, LinkedIn or WhatsApp
- Fake log-in portalTargets are enticed into portals designed to capture their credentials
- Persistence and C2Custom malware plus legitimate cloud services such as Google Drive and OneDrive
Persistence & C2
APT35 maintains its access through a mix of custom malware and legitimate cloud-based services:
- Malware: POWERSTAR, CHAINSHOT, Tickler, DustySky, HookStick.
- C2 Infrastructure: Use of Google Drive, OneDrive, and other “Software as a Service” tools enables exfiltration of data or helps to maintain persistence.
Techniques
Occasionally, destructive capabilities have been included. So the line between espionage and disruption becomes blurred.
Credential harvesting remains a hallmark of APT35.
Watering hole attacks and VPN abuse have also been identified.
Fake personas and disinformation campaigns on social media have been used.
Who Does APT35 Target?
APT35 targeting suggests Iran’s geopolitical interests:
- Sectors: Government, defense, academia, NGOs, think tanks, technology, human rights organizations, and media.
- Geographies: Billions of dollars have been spent on targeting. Countries of focus are the United States, Israel and the Gulf States. Operations, including targeting, have also spread to Europe and global dissident communities.
Targets are often policy experts, journalists and researchers. This is because of their influence on foreign policy discussions and debates.
Notable Operations
• 2014-2015: Newscaster Campaign
APT35 impersonated journalists through fabricated online personas and websites to engage and phish their political and defense targets.
• 2018: University Credential Theft:
Thousands of United States and Middle East university accounts were breached to facilitate intelligence collection.
• 2020: COVID-19 Espionage
Utilizing the pandemic, APT35 targeted pharmaceutical firms and health organizations to acquire valuable medical research.
• 2021: DustySky & CHAINSHOT Campaigns
Targeted Israeli defense and technology companies with cutting-edge malware payloads.
• 2022-2023: Activists and Journalists
A global spear phishing campaign directed against dissidents and Human Rights advocates including efforts to gain access to email and social media accounts.
• 2024: U.S. Election Operations
APT35 conducted phishing and influence operations against policy experts, think tanks, and journalists associated with U.S. elections.
• 2025: POWERSTAR & Tickler Campaigns
APT35 continued intrusions against Universities and research firms showing sustained interest in the academic setting.
- 2014-2015Newscaster CampaignImpersonated journalists through fabricated online personas and websites to phish political and defense targets.
- 2018University Credential TheftThousands of United States and Middle East university accounts were breached.
- 2020COVID-19 EspionageTargeted pharmaceutical firms and health organizations to acquire medical research.
- 2021DustySky and CHAINSHOT CampaignsTargeted Israeli defense and technology companies.
- 2022-2023Activists and JournalistsGlobal spear phishing against dissidents and human rights advocates.
- 2024U.S. Election OperationsPhishing and influence operations against policy experts, think tanks and journalists.
- 2025POWERSTAR and Tickler CampaignsIntrusions against universities and research firms.
Evolution & Recent Developments
APT35 has also evolved its tradecraft consistently:
- Moved from basic phishing activity to compromises targeting the supply chain.
- Used AI-assisted generated content and deepfakes to lend credibility to disinformation.
- Grew its toolkit with malware families built to work alongside commodity tools.
- Actively sought to target global NGOs and policy organizations to shape narratives of foreign policy.
APT35’s evolution is representative of a larger Iranian strategic objective. That aim is to blend espionage with psychological operations. These are skilled efforts to weaken adversaries step by step, both technically and politically.
Conclusion
APT35 is not the most technically advanced threat actor. But the tenacity and flexibility of its operations make it a credible and persistent threat. They are in line with Iranian strategic objectives. Its operations illustrate a wider evolution of cyber operations. They go beyond espionage and profit, but as influence and control of narratives.
Key takeaways for the defensive community include:
- Awareness: Phishing and impersonation training is still paramount.
- Cloud Security Monitoring: Watch for misuse of legitimate applications such as Google Drive or OneDrive.
- Election and Policy Security: Protect political organizations, NGOs, and research institutions – clear targets for APT35.
APT35’s trajectory indicates that as geopolitical tensions continue to rise, operations will increase as well. This makes it a prevalent threat actor to watch in the coming years.
You can download and review the sheet for all the details!
