APT35's Exploitation of Microsoft Exchange: Targeting Europe, Middle East, and North America

In December 2021, APT35 (also known as Charming Kitten and Phosphorus) exploited three Microsoft Exchange vulnerabilities — collectively known as ProxyShell — to break into organizations across Europe, the Middle East, and North America. Once inside, the group deployed web shells, disabled security tools, created hidden persistence mechanisms, dumped credentials from system memory, and exfiltrated the results to attacker-controlled servers.

The attacks are attributed to APT35, an Iranian state-sponsored cyber-espionage group also tracked as Charming Kitten and Phosphorus. The group has been active since at least 2014 and is assessed to operate in support of Iran's strategic intelligence priorities. Their campaigns consistently target government, military, academic, and energy sector organizations in countries considered rivals or adversaries of Iran.

The primary goals were credential theft, network reconnaissance, and persistent access to strategic targets. APT35 disabled endpoint defenses, forced plaintext password storage via WDigest, dumped authentication credentials from memory, and set up multiple re-entry routes through scheduled tasks and RDP-enabled local accounts. The intelligence gathered supports Iran's long-term geopolitical and military interests.

The campaign targeted organizations in Europe, the Middle East, and North America. Any organization running an unpatched, internet-facing Microsoft Exchange server was at risk. APT35's broader targeting history shows a particular focus on the United States and Middle Eastern countries, spanning government, military, academic, energy, and telecommunications institutions.

APT35 primarily targets government entities, academic institutions, military and defense organizations, energy companies, media outlets, engineering firms, and telecommunications providers. The group has a documented history of targeting individuals and institutions in the United States, Israel, and Middle Eastern countries — particularly those with access to sensitive policy, scientific, or intelligence information.

The attack began by exploiting ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) in internet-facing Exchange servers to deploy web shells. From those shells, APT35 downloaded batch files and XML-based scheduled tasks for persistence, then disabled Microsoft Defender by modifying Windows registry keys. They created a local account with administrator privileges, opened port 3389 via the firewall for RDP access, disabled LSA protection, and enabled WDigest so Windows would store future login credentials in plaintext. Finally, they used rundll32.exe with comsvcs.dll to dump LSASS memory containing credential hashes, and sent the dump to their C2 infrastructure via HTTP POST.

Organizations running Microsoft Exchange are central to email communications and often hold sensitive data, making them high-value targets. Government and defense organizations in countries opposed to Iran's interests are of direct intelligence value. Academic institutions and think tanks frequently hold unpublished research, policy analysis, and sensitive personal contacts. The ProxyShell vulnerabilities allowed APT35 to gain access without needing to trick an individual employee — any unpatched public-facing Exchange server was a potential entry point.