Part 2 Comprehensive Guide to Advanced Persistent Threat (APT) Groups

1. The Enigma of APT35

Attribution: Iran (Government-Sponsored)

Target Sectors: U.S., Western Europe, and Middle Eastern military, diplomatic, and government personnel. Also, media, energy, defense, and telecommunications sectors.

Operations:

• Complex social engineering efforts.
• Relatively nascent development capability.

Associated Malware: ASPXSHELLSV, BROKEYOLK, PUPYRAT, TUNNA, MANGOPUNCH, DRUBOT, HOUSEBLEND.

Attack Vectors: Spearphishing with lures related to health care, job postings, resumes, or password policies.

2. The Tools of the Trade

APT35 wields a blend of custom and public malware, backdoors, and tools:

• ASPXSHELLSV: Concealed conversations with command and control (C2) servers.
• BROKEYOLK: For initial compromise.
• PUPYRAT: Compressing stolen data.
• TUNNA: Exfiltrating data from compromised hosts.
• MANGOPUNCH: Ensuring longevity.
• DRUBOT: Unveiling credentials.
• HOUSEBLEND: Executing malicious code.