Actors/Nation-state / APT/Asia

APT35

G0059APTIR · Iran

AKA Newscaster · Mint Sandstorm · Magic Hound · Educated Manticore · NewsBeef · Yellow Garuda · ITG18

Microsoft: PhosphorusCrowdStrike: CHARMING KITTENMITRE: G0059Proofpoint: TA453Secureworks: COBALT ILLUSION

Targets19

Sectors19

Threat types1

GIRs covered0/480

Active since2014

Also tracked as

6 vendor names · 7 other aliases

Open Rosetta Stone

CrowdStrike

CHARMING KITTEN

Mandiant

APT35

Microsoft

Phosphorus

MITRE

G0059

Proofpoint

TA453

Secureworks

COBALT ILLUSION

UNATTRIBUTED ALIASESNewscasterMint SandstormMagic HoundEducated ManticoreNewsBeefYellow GarudaITG18

Victimology

Geographic footprint · 19 countries

origin · Irantargeted countries · 19

ASIA · 9

United Arab Emirates · Azerbaijan · Israel · India · Iraq · Iran · Kuwait · Saudi Arabia · Türkiye

EUROPE · 6

Albania · Switzerland · Germany · United Kingdom · Latvia · Netherlands

OCEANIA · 1

Australia

AFRICA · 1

Egypt

AMERICAS · 2

United States · Uruguay

Sectors targeted

19 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors Telecom72 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Transportation31 actors Legal & Professional18 actors Chemicals20 actors Dissidents (as targets)16 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 52 techniques

Reconnaissance · 4

T1589.001Credentials T1589.002Email Addresses T1591.001Determine Physical Locations T1592.002Software

Resource Development · 1

T1583.006Web Services

Initial Access · 4

T1189Drive-by Compromise

Execution · 6

T1047Windows Management Instrumentation

Persistence · 2

T1098.002Additional Email Delegate Permissions

Credential Access · 1

T1003.001LSASS Memory

Discovery · 8

T1016System Network Configuration Discovery

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1570Lateral Tool Transfer

Collection · 5

T1005Data from Local System T1113Screen Capture T1114.001Local Email Collection

Exfiltration · 1

T1567Exfiltration Over Web Service

Impact · 1

T1486Data Encrypted for Impact

Command And Control · 7

T1071Application Layer Protocol T1071.001Web Protocols T1090Proxy

Defense Impairment · 2

T1112Modify Registry

Stealth · 8

T1027.010Command Obfuscation T1036.004Masquerade Task or Service

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer52 techniques · layer format 4.5

Related actors

By origin and actor type

T1190

Exploit Public-Facing Application

T1566.002Spearphishing Link

T1566.003Spearphishing via Service

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1018

Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1482Domain Trust Discovery

T1114.002

Remote Email Collection

T1560.001Archive via Utility

T1102.002

Bidirectional Communication

T1105Ingress Tool Transfer

T1571Non-Standard Port

T1573Encrypted Channel

T1685

Disable or Modify Tools

T1036.005

Match Legitimate Resource Name or Location

T1036.010Masquerade Account Name

T1070.004File Deletion

T1078.002Domain Accounts

T1218.011Rundll32

T1564.003Hidden Window