Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT35. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (32)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• clearskysec.comhttp://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf
• attack.mitre.orghttps://attack.mitre.org/groups/G0059
• blog.certfa.comhttps://blog.certfa.com/posts/charming-kitten-christmas-gift/
• blogs.microsoft.comhttps://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/
• blogs.microsoft.comhttps://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• noticeofpleadings.comhttps://noticeofpleadings.com/phosphorus/files/Complaint.pdf
• research.checkpoint.comhttps://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
• researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/
• securityintelligence.comhttps://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/
• static.carahsoft.comhttps://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf
• clearskysec.comhttps://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf
• clearskysec.comhttps://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf
• eweek.comhttps://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering
• proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential
• proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/cobalt-illusion
• fireeye.comhttps://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf
• attack.mitre.orghttps://attack.mitre.org/groups/G0059/
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/magic-hound
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-magic-hound-campaign-attacks-saudi-targets/
• securityaffairs.cohttps://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html
• cfr.orghttps://www.cfr.org/cyber-operations/apt-35
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/
• sentinelone.comhttps://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/
• secureworks.comhttps://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/iranian-attackers-impersonate-model-agency/
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/