APT35Threat actor
- Agent Serpens
- Charming Kitten
- charmingcypress
- cobalt illusion
- cobalt mirage
- g0058
- g0059
- group 83
- ikittens
- itg18
- Magic Hound
- mint sandstorm
- newsbeef
- newscaster
- newscaster team
- parastoo
- phosphorus
- rich ion
- ta453
- tunnelvision
FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored by the Iranian government that conducts long term, resource-intensive operations to collect strategic intelligence. APT35 typically targets U. S.From MISP Galaxy
Last reported 18 days ago, by Palo Alto Unit 423 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1684Social Engineering
“The attackers used tailored social engineering tactics, weaponizing recruitment lures aimed at Iraqi software developers and engineers.”
- T1036Masquerading
“We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1047Windows Management Instrumentation
“Windows Management Instrumentation (WMI)”
- T1127Trusted Developer Utilities Proxy Execution
“This technique is classified as Trusted Developer Utilities Proxy Execution.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“Agent Serpens”
-
Federal & Mission-Critical Security Validation“The flaw that enables full domain compromise and aligns directly with how Iranian groups like MuddyWater and Magic Hound operate.”
-
AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict“In February 2026, Google’s GTIG AI Threat Tracker reported that GreenBravo (also known as APT42, Charming Kitten, Mint Sandstorm) has been using Gemini “as an engineering platform to accelerate the development of specialized malicious tools,” including for debugging, code generat…”
Indicators in its reports
named in the reports above- hxxps://api.github[.]com/repos/peakyblinders-tm/myLic/contents/in 1 report
- 91.107.156[.]29in 1 report
- 6e7d9b33f1e72ea1…de9ecd1fd239in 1 report
- f5b12772db6817f7…4a372a410fc9in 1 report
- 53f35e49eb9b271f…be0363daa402in 1 report
- 3fd810a3aa003999…0887cdd3ed13in 1 report
- 76273382e4252c1f…891762c0682ein 1 report
- d3561bd4aad003dc…08ab1d4e8260in 1 report
- 65.109.214[.]145in 1 report
- f5ba1645694c62f5…37e72803b4bdin 1 report
- 87.248.129[.]239in 1 report
- 7cc571aca6d8715d…7c5d00a1f875in 1 report
- 38.180.136[.]127in 1 report
- googeldrive[.]camin 1 report
- drivegoogel[.]camin 1 report
- googelmeet[.]onlinein 1 report
- meetonline[.]camin 1 report
- asdfafadafg[.]onlinein 1 report
- hxxps://github[.]com/peakyblinders-tmin 1 report
- hxxps://github[.]com/GreenBeret0in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.