Threats Feed

Deep Instinct researchers detected suspicious activity in a Southern U.S. infrastructure and construction company, revealing an attempted compromise of an Exchange server by an Iranian APT, PHOSPHORUS. Seven exploitation attempts were made, including installation of a root certificate and blending malicious traffic with legitimate. The attacker used malware to create a new user account, setup RDP access, and establish a reverse proxy to connect to the compromised system. A new evasion technique, involving masking malicious domains within legitimate ones, was also detected. PHOSPHORUS activities can be traced back to June 2020.

In early February 2022, the TunnelVision threat actor exploited a vulnerable VMware Horizon server using the Log4Shell vulnerability (CVE-2021-44228) to gain unauthorized access. The attack involved suspicious account creation, credential harvesting, and lateral movement using PSexec and RDP. The adversaries also harvested credentials using Procdump and downloaded Sysinternals and SSH tools. The intrusion was attributed to the Iranian-aligned TunnelVision activity cluster, based on observed TTPs and artifacts. The targeted sectors and countries are not specified in the report.

SentinelLabs tracks TunnelVision, an Iranian-aligned threat actor operating in the Middle East and the United States, characterized by wide exploitation of 1-day vulnerabilities and heavy reliance on tunneling tools. In early 2022, the group actively exploited the Log4Shell vulnerability (CVE-2021-44228) in VMware Horizon servers, spawning malicious processes via the Tomcat service to run PowerShell commands, deploy backdoors, create backdoor administrator accounts, harvest credentials via Procdump, SAM hive dumps, and comsvcs MiniDump, and perform lateral movement using Plink and Ngrok to tunnel RDP traffic. The group also previously exploited Fortinet FortiOS (CVE-2018-13379) and Microsoft Exchange ProxyShell (CVE-2021-34473). TunnelVision used a GitHub account ("protections20") to host payloads, and leveraged legitimate services including transfer.sh, pastebin.com, webhook.site, and ufile.io for C2 communication. A custom backdoor dropped as InteropServices.exe bears similarities to the PowerLess backdoor used by Phosphorus (Microsoft attribution), and the group has been linked to ransomware deployment — making it a potentially destructive actor beyond its espionage activities. SentinelLabs tracks this cluster separately from Phosphorus/Charming Kitten/Nemesis Kitten due to insufficient overlap data for a definitive merge.

Iranian APT group Phosphorus has developed a new PowerShell backdoor, dubbed PowerLess Backdoor, for espionage purposes. Cybereason researchers discovered the backdoor while investigating the group's exploitation of the ProxyShell vulnerability. The backdoor allows for downloading additional payloads, evasive PowerShell execution, and encrypted communication with the command and control server. Connections were also found between the Phosphorus group and the Memento Ransomware.

APT35 has started widespread scanning and attempts to leverage the Log4j flaw in publicly facing systems only four days after the vulnerability was disclosed. The group used a modular PowerShell-based framework dubbed CharmPower for persistence, information gathering, and command execution.

The DFIR Report's November 2021 case study documents a PHOSPHORUS (APT35/Charming Kitten) intrusion in late September 2021 in which the attacker exploited the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) on an internet-facing Microsoft Exchange server. Over 42 hours, three web shells were deployed in OWA directories. The attacker used PowerShell and cmd.exe via web shells to run Exchange discovery cmdlets (Get-Mailbox, Get-ExchangeServer), then enabled the built-in DefaultAccount, set its password to P@ssw0rd, and added it to Administrators and Remote Desktop Users groups. Plink was used to establish an SSH tunnel to 148.251.71[.]182 (tcp.symantecserver.co), exposing RDP externally. LSASS was dumped via Task Manager. Fast Reverse Proxy (FRP, renamed to dllhost.exe) was deployed for persistent RDP proxying via a scheduled task named CacheTask. Using stolen domain admin credentials, the actors performed internal port scanning with KPortScan 3.0, moved laterally to backup systems and domain controllers via RDP, and deployed Impacket's wmiexec on one domain controller. The final impact was domain-wide encryption: BitLocker on servers (via setup.bat) and DiskCryptor on workstations via dcrypt.exe, with a ransom note requesting 8,000 USD left on an unencrypted domain controller. No data exfiltration or Cobalt Strike was used — notably rare for a ransomware intrusion of this scale.

APT35 has used multiple tactics to compromise high-value targets. The group has used hijacked websites, such as one affiliated with a UK university, for credential phishing attacks. They have also uploaded spyware disguised as VPN software to app stores and impersonated conference officials to conduct phishing campaigns. Additionally, APT35 has utilized link shorteners and click trackers embedded within PDF files and abused services like Google Drive, App Scripts, and Sites pages. The group has adopted a novel approach by leveraging Telegram for real-time operator notifications, enabling them to monitor visitor information to their phishing sites.

APT35, also known as Charming Kitten, had infiltrated an organization in the EMEA region. The infected corporate device was only engaged in command and control (C2) beaconing and showed no signs of lateral movement or data exfiltration. Despite a mature security stack, the organization was unaware of the infection until the new security measures were implemented.

In December 2021, PHOSPHORUS exploited the Microsoft Exchange ProxyShell vulnerabilities, using web shells to gain initial access and execute code. The attack closely resembled their previous attacks and due to previous reports and OSINT research, DFIR believes with medium to high confidence that this intrusion would have ended in ransomware. The attackers established persistence through scheduled tasks and a newly created account, and after enumerating the environment, disabled LSA protection and dumped LSASS process memory. The entire attack was likely scripted out, as evidenced by the user agent strings and the similarity between commands.

During the 2021 Christmas holidays, Iranian state-backed hackers Charming Kitten initiated a targeted phishing campaign against individuals, focusing on personal and business emails. The group used public-facing applications, such as Google services, to redirect victims through a chain of legitimate services, helping bypass security layers in email services and obfuscate their operations. They employed various fake domains and developed custom phishing pages to target a range of online services, collecting sensitive data and emails from victims.

The Iranian threat actor Phosphorus targeted potential attendees of the Munich Security Conference and the Think 20 (T20) Summit in Saudi Arabia through a series of cyberattacks. The attackers sent spoofed email invitations to former government officials, policy experts, academics, and leaders from non-governmental organizations. Their goal was intelligence collection, and they successfully compromised several high-profile individuals' accounts.

ClearSky researchers documented a new Charming Kitten (APT35) campaign that, starting July 2020, expanded their established journalist-impersonation playbook to include WhatsApp and LinkedIn as primary contact channels — a first for this group. Attackers impersonated Persian-speaking journalists from Deutsche Welle and the Jewish Journal, initiating contact via email before moving conversations to WhatsApp using German phone numbers (+49 prefix) and voice calls to build credibility. If victims declined to share their phone number, a fake LinkedIn profile (such as "Marcy Oster" or "Helen Cooper") was used to continue the approach. The ultimate goal was credential theft: victims were invited to a fake webinar via a personalized phishing link on the legitimate Deutsche Welle domain (akademie.dw[.]de), leading to a spoofed Outlook login page that harvested university credentials, including bypassing 2FA. In some cases, a malicious file attachment was also sent via LinkedIn. Targets included Israeli academics from Haifa and Tel Aviv Universities, US government officials and former State Department employees, the Baha'i community, and COVID-19-related organizations. Each victim received a uniquely personalized phishing link tied to their specific email address. Deutsche Welle confirmed to ClearSky that none of the impersonated journalists contacted the victims.

IBM X-Force IRIS uncovered extensive details on ITG18 through operational errors. Over 40 GB of data and videos revealed ITG18’s targeting of U.S. Navy and Hellenic Navy personnel, U.S. presidential campaigns, pharmaceutical companies, and Iranian-American figures. The group employed credential harvesting, phishing, and email compromise, often using Zimbra to manage compromised accounts. ITG18's operations align with Iranian strategic interests, leveraging personal accounts to gather sensitive data on military operations and geopolitical targets. Multifactor authentication posed challenges, causing operators to pivot to new targets.

The Iranian hacking group Charming Kitten, closely associated with Iran's intelligence services, has launched a new series of phishing attacks targeting journalists, political activists, and human rights advocates. These attacks, consistent with the group's previous activities, also aim at private and government institutions, think tanks, academic institutions, and organizations linked to the Baha'i community in the United States, United Kingdom, Saudi Arabia, and Europe. The attackers use fake interview scenarios, impersonating journalists from prominent media outlets like the Wall Street Journal, to gain victims' trust and direct them to phishing sites. These sites capture sensitive information like passwords and two-factor authentication codes. The campaign also involves a backdoor malware named "pdfreader.exe", which alters system settings for remote access and data exfiltration.

ClearSky's October 2019 report documented an active Charming Kitten (APT35/Phosphorus) campaign targeting US presidential campaign staff, government officials, journalists, Iranian dissidents, and civil society figures including the Baha'i community. The campaign used four distinct impersonation vectors: fake Google Drive sharing links, SMS phishing messages, spoofed account login-attempt alerts, and fake social network profiles impersonating known contacts. Malicious links led to credential-harvesting pages mimicking Google, Yahoo, Facebook, and Instagram logins, hosted on a network of actor-registered domains. The group abused Google Sites and URL shorteners to obfuscate malicious destinations. Microsoft identified 99 domains tied to the operation (tracked internally as Phosphorus/Strontium) and obtained a court order to seize them. IOC overlaps with prior Certfa reporting confirm continuity of infrastructure across Charming Kitten campaigns dating to 2018. The campaign is assessed as part of Iran's broader effort to conduct cyber-enabled political intelligence collection ahead of the 2020 US presidential election.

The Iranian APT group Charming Kitten (APT35) conducted a cyberespionage campaign targeting academic researchers, human rights activists, media personnel, and public figures across the Middle East, US, UK, and France. Using spearphishing emails and fake websites mimicking Google and Instagram, the group sought to steal credentials and track email activity. They also impersonated journalists and researchers to deceive victims into sharing sensitive information. Key targets included Iranian dissidents, non-Iranian researchers focused on Iran, and influential public figures. The campaign employed social engineering, custom infrastructure, and domain impersonation, leveraging hosting services in Bulgaria and Germany. Notable tactics included phishing for credentials and redirecting victims to decoy domains.

The Iranian APT group Charming Kitten impersonated Israeli cybersecurity firm ClearSky by creating a phishing website that mimicked the legitimate Clearskysec.com domain. The fake site, hosted on an older compromised server, replicated ClearSky's public web pages and included phishing login options to harvest credentials. ClearSky identified the incomplete site, which was taken down before it could affect any victims. Charming Kitten has previously targeted academic researchers, human rights activists, media outlets and political consultants in Iran, the US, UK and Israel. Known for spear-phishing, impersonating organisations, and deploying malware such as DownPaper, this campaign underscores the ongoing threat to security researchers and geopolitical targets.

Beginning in late 2016, Shamoon 2.0 and the newly discovered StoneDrill malware launched destructive wiper attacks against critical and economic sectors in Saudi Arabia, with evidence of StoneDrill reaching European targets. Shamoon 2.0, a successor to the 2012 Saudi Aramco attack tool, incorporated stolen administrator credentials, automated worm-like spreading, disk wiping, and even inactive ransomware capabilities. StoneDrill introduced advanced sandbox evasion, injected its payload into browsers, and targeted accessible files or full disks. Both malware families used obfuscation, anti-analysis tricks, and in Shamoon’s case, signed drivers for low-level destruction. StoneDrill shared code similarities with the NewsBeef (aka Charming Kitten) APT, suggesting broader regional targeting and actor overlap.

The report details the Magic Hound cyber campaign targeting primarily Saudi Arabia. The campaign leveraged spearphishing emails with malicious attachments and links, PowerShell scripts, Windows Command Shell, and obfuscation techniques like XOR and Base64 encoding. Additionally, the attackers utilized HTTP and HTTPS protocols for command and control communication.

The MacDownloader malware, initially observed targeting the defense industrial base and a human rights advocate, impersonates legitimate software like Adobe Flash Player and Bitdefender Adware Removal Tool to steal system information and macOS Keychain data. It reflects initial development efforts by possibly amateur Iranian-affiliated actors and is linked to previously documented Iranian operations targeting aerospace and defense employees. The malware, which also gathers user credentials, lacks effective persistence features and uses similar infrastructure as previous campaigns attributed to the Iranian group Charming Kitten.