Loading story…
Leaked internal documents and previously exposed operator recordings have provided an unusually detailed view into the operations of Charming Kitten—also tracked as APT35, Phosphorus, and Mint Sandstorm—an Iranian state-linked cyber-espionage group reportedly affiliated with the IRGC. The leaked cache published in late 2025 described formal command structures, campaign workflows, target lists, and attack playbooks, while earlier video footage reportedly captured operators conducting intrusions and stealing data from email accounts after accidentally exposing recordings on an internet-accessible server. Together, the materials depict a mature intelligence operation using phishing, credential harvesting, web shells, OSINT, mass scanning, and exploitation of vulnerabilities in products including ConnectWise, Ivanti Connect Secure, PHP-CGI, Telerik UI, Confluence, GitLab, WordPress plugins, and Jenkins.
The exposed records indicate that APT35 conducted both targeted and opportunistic campaigns across the Middle East, including activity affecting government bodies, telecom systems, legal entities, and internet-facing infrastructure in Israel, Jordan, Afghanistan, Saudi Arabia, Turkey, and the United Arab Emirates. Reported theft included 74 GB of data tied to Jordan-linked targets and thousands of emails from Afghan ministries. Separate infrastructure analysis in 2026 also found domains and rogue mail subdomains likely prepared for phishing against Egyptian shipping and marine services companies, with researchers linking the setup to Iran-aligned activity consistent with APT35 and suggesting possible compromise of legitimate DNS or cPanel configurations to support the operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A leaked cache of internal documents exposing Charming Kitten’s organization, workflows, targets, and attack methods was published. The materials included campaign briefs, target lists, exploitation guides, scan reports, credentials, databases, and evidence of compromises across multiple Middle Eastern countries.
Charming Kitten launched the opportunistic Operation Swiftstrike against targets in Turkey, Saudi Arabia, Jordan, and the United Arab Emirates. The campaign used mass scanning and internet-wide search tools alongside exploitation of ConnectWise and Ivanti vulnerabilities.
Operation Desert Breach began targeting Jordan, including the Ministry of Justice, academic institutions, and legal professionals such as law firms. The campaign relied heavily on exploitation of CVE-2012-1823 and used web shells for persistence, resulting in more than 74 GB of exfiltrated data.
Charming Kitten ran Operation Shattered Mirror against Israel, compromising modems, routers, and commercial websites to support surveillance and credential collection. The operation also included phishing political opponents of the Israeli government using fake conference entry cards.
Charming Kitten conducted Operation Afghan Infiltration against Afghan telecommunications systems and government bodies, including the Ministry of Tribal and Border Affairs and the Ministry of Refugees and Repatriation. The campaign enabled exfiltration of emails and internal accounts to support long-term surveillance.
IBM’s Black Hat presentation states that Microsoft won a criminal complaint in March 2019 that sinkholed 99 ITG18 domains, including identifier-services-sessions.info on March 27, 2019. IBM said the actor adapted about three weeks later by shifting to a replacement domain, identifier-services-session.site.
SecurityScorecard reported that domains and rogue subdomains tied to infrastructure associated with Iran-linked activity were likely prepared for phishing campaigns targeting Egypt-based shipping and marine services companies and other regional organizations. The company assessed with high confidence that the targeting pattern and infrastructure overlap were consistent with APT35/Charming Kitten.
Google Threat Analysis Group published reporting on the Iranian HYPERSCRAPE data extraction tool and identified command-and-control infrastructure including 136.243.108[.]14 in Germany and 173.209.51[.]54 in Canada. This reporting later served as a pivot point for SecurityScorecard’s infrastructure analysis.
IBM’s X-Force security team obtained roughly five hours of recordings that appeared to show APT35 operators conducting hacking activity. The footage reportedly exposed how the group stole data from email accounts and identified targets after the videos were allegedly uploaded to an unprotected internet-accessible server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcegatewatcher.com
Open sourcewired.com
Open sourcei.blackhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant leak of internal operational documents allegedly belonging to the Iranian state-sponsored threat group APT35, also known as Charming Kitten, has surfaced online. The dataset, which appeared on a public repository in late September 2025, contains over 100 files of Persian-language internal documentation, including personnel rosters, tooling details, campaign reports, and organizational charts. Analysis of the leak reveals a highly coordinated structure within APT35, with dedicated teams for penetration testing, malware development, social engineering, and infrastructure compromise. The documents detail the group’s rapid exploitation of vulnerabilities such as CVE-2024-1709 and their use of mass router DNS manipulation to compromise targets. Victims identified in the leak span government, legal, academic, aviation, energy, and financial sectors, primarily in the Middle East, but also include targets in the United States and Asia. The operational materials highlight the group’s use of custom remote access trojans (RATs), advanced endpoint detection and response (EDR) evasion techniques, and supply-chain attack vectors. The leak also exposes the group’s sophisticated phishing infrastructure and their ability to achieve long-term persistence and Active Directory dominance within compromised environments. The documents provide insight into the group’s vulnerability research activities, targeting platforms such as Confluence, WordPress, Ivanti, and Apache. Additionally, the leak includes open-source intelligence (OSINT) on targets and detailed attack reports, including domain information and mentions of remote access tools like Anydesk. The individual or group responsible for the leak, operating under the alias KittenBuster, has stated their intention to release further evidence and personal information about APT35 members in the coming days. Security researchers are working to verify the authenticity of the leak, but initial assessments indicate a high degree of credibility based on language, content, and context. The exposure of these materials represents a rare and valuable opportunity for the cybersecurity community to gain insight into the tradecraft, organizational structure, and operational priorities of a major Iranian cyber-espionage group. The leak underscores the acute supply-chain and national security risks posed by IRGC-affiliated actors and highlights the need for heightened vigilance among organizations in targeted sectors. The ongoing release of additional documents may further illuminate the group’s tactics, techniques, and procedures (TTPs), enabling defenders to better anticipate and mitigate future threats. This incident marks one of the most comprehensive public exposures of Iranian APT operations to date, with potential implications for both regional and global cybersecurity.
Jun 29, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026