Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

MITRE Techniques

• [T1190] Exploit Public-Facing Application – Used to weaponize Exchange and Ivanti vulnerabilities for initial access (‘run ProxyShell, Autodiscover, and EWS attacks;’).
• [T1505.003] Web Shell – Public-facing webshells used for hands-on control and staging (webshell filename pattern ‘m0s.*’ observed across targets: ‘m0s.*’).
• [T1003.001] OS Credential Dumping: LSASS Memory – Memory dumps with plaintext credentials and NTLM hashes (LSASS dump ‘mfa.tr.txt’ containing plaintext creds & NTLM hashes: ‘LSASS dump (Mimikatz) from MFA.KKTC, Apr 2022 , plaintext creds & NTLM hashes.’).
• [T1566] Phishing – HERV-style phishing campaigns weaponized with harvested GAL contacts to collect credentials and drive persistent access (‘phishing herv.pdf … HERV, style lure templates, campaign metrics, and operational procedures for turning harvested GALs into active collection nodes.’).
• [T1114] Email Collection – Sustained mailbox monitoring and GAL exportation used for HUMINT collection (‘validate shells and extract Global Address Lists (GALs); weaponize harvested contacts with HERV phishing; and maintain sustained intelligence collection through mailbox monitoring.’).
• [T1071.001] Application Layer Protocol: Web Protocols – C2 and operator command channels over HTTP(S) using Accept-Language header and static header token (‘Python clients … embed the command inside an HTTP header (notably Accept-Language) … accompanied by a static header token’).
• [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell automation used for exploit chains, GAL exports, and in-memory loaders (‘weaponized PowerShell scripts for GAL exports’).
• [T1047] Windows Management Instrumentation – Remote execution and lateral movement via WMIC observed in operator tool UI and scripts (‘the operator then dispatches … WMIC and net use commands programmatically’).
• [T1021.001] Remote Services: SMB/Windows Admin Shares – Lateral movement using net use and SMB admin share mounts for remote execution (‘net use C$’ used to execute queued commands).’
• [T1550] Use of Valid Accounts – Credential reuse, token replay, and OAuth token abuse employed for persistence and pivoting (‘credential replay and reuse … OAuth token replay for persistent access’).
• [T1036] Masquerading – Stagers and persistence artifacts hidden under plausible system-like filenames and ProgramData paths (‘place[s] artifacts into ProgramData and masqueraded under plausible Windows service names … vmware-tools.exe’).
• [T1567.002] Exfiltration to Cloud Storage – Data staged to cloud services such as Mega/Dropbox/ProtonDrive using encrypted archives (‘exfiltration channels include encrypted 7zip archives staged to cloud storage (Mega, Dropbox, ProtonDrive)’).