Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT35 · Unknown · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT35

  • Newscaster Team
  • Magic Hound
  • G0059
  • Phosphorus
  • Mint Sandstorm
  • TunnelVision
  • COBALT MIRAGE
  • Agent Serpens

MITRE G0059 ↗

APT35 — ATT&CK roseAP

attack rose · 78 techniques across 14 tactics

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2018-13379, CVE-2021-31207, CVE-2021-34473, CVE-2021-34523, CVE-2021-44228

Analyst brief

misp-galaxy + mitre-attack

FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored by the Iranian government that conducts long term, resource-intensive operations to collect strategic intelligence. APT35 typically targets U.S. and the Middle Eastern military, diplomatic and government personnel, organizations in the media, energy and defense industrial base (DIB), and engineering, business services and telecommunications sectors.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

78 techniques · 14 of 15 tactics

  1. Reconnaissance

    8 techniques

  2. Resource development

    7 techniques

  3. Initial access

    4 techniques

  4. Execution

    7 techniques

  5. Persistence

    5 techniques

  6. Stealth

    11 techniques

  7. Defense impairment

    4 techniques

  8. Credential access

    1 technique

  9. Discovery

    12 techniques

  10. Lateral movement

    2 techniques

  11. Collection

    7 techniques

  12. Command and control

    8 techniques

  13. Exfiltration

    1 technique

  14. Impact

    1 technique

select a technique

Arsenal

3 malware · 10 tools
Malware
Malware · 3ATT&CK
CharmPowerS0674 ↗
PowerLessS1012 ↗
DownPaperS0186 ↗
Tools
Tools · 10ATT&CK
NetS0039 ↗
ImpacketS0357 ↗
PingS0097 ↗
FRPS1144 ↗
MimikatzS0002 ↗
SysteminfoS0096 ↗
ipconfigS0100 ↗
netshS0108 ↗
PupyS0192 ↗
PsExecS0029 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT35 is cited as exploiting

none on KEV
  1. CVE-2018-133792026-10-17
    1. “Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2021-312072026-10-17
    1. “Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2021-344732026-10-17
    1. “Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2021-345232026-10-17
    1. “Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2021-442282026-10-17
    1. “Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “To exploit the Log4j vulnerability (CVE-2021-44228), the attackers chose one of the publicly available open-source JNDI Exploit Kits”

      cited as exploiting · named nearby · source: research.checkpoint.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022APT35 Automates Initial Access Using ProxyShellTheDFIRreport ↗
  2. 2017Magic Hound Campaign Attacks Saudi TargetsPalo Alto Networks ↗
  3. 2017Charming Kitten: Iranian Cyber Espionage Against Human Rights ActivistsClearsky ↗
  4. 2017Charming Kitten: CSV DataClearsky ↗

Take it with you

keyless · no signup

References

22 sources
  1. 1.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf
  2. 2.attack.mitre.org/groups/G0059
  3. 3.cfr.org/interactive/cyber-operations/magic-hound
  4. 4.unit42.paloaltonetworks.com/unit42-magic-hound-campaign-attacks-saudi-targets
  5. 5.securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html
  6. 6.cfr.org/cyber-operations/apt-35
  7. 7.blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customer…
  8. 8.research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-…
  9. 9.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iran…
  10. 10.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-t…
  11. +12 more in the JSON record

Track APT35 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.