BladedFeline

BladedFeline is an Iranian-aligned cyber espionage group active since at least 2017, assessed by ESET with medium confidence to be a subgroup of OilRig (APT34). The group has maintained persistent unauthorized access to systems within the Kurdistan Regional Government since 2017 and has also compromised officials in Iraq's central government and a telecommunications provider in Uzbekistan. Its primary objective is intelligence collection on Kurdish and Iraqi government officials, motivated by Iran's interest in monitoring the Kurdistan region's diplomatic ties with Western nations and its oil reserves. BladedFeline deploys a continuously evolving custom toolset: the Whisper backdoor communicates via compromised Microsoft Exchange accounts using email attachments for covert command and control; the PrimeCache malicious IIS module serves as a passive backdoor triggered via crafted cookie headers; and reverse tunneling tools Laret and Pinar enable persistent network access. Code overlaps between PrimeCache and OilRig's RDAT backdoor support the subgroup attribution.