# APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting

> Iran-linked APT35 (Charming Kitten), an IRGC-affiliated threat group, conducted years of systematic cyber reconnaissance and pre-positioning across GCC nations including UAE, Saudi Arabia, Qatar, Kuwait, and Bahrain. The pre-positioned access directly enabled targeting data for Iran's coordinated missile and drone strikes against seven nations following Operation Epic Fury on February 28, 2026, demonstrating a dangerous convergence of cyber and kinetic warfare.

- **Published:** 2026-04-09T12:00:00Z
- **Last reviewed:** 2026-04-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0339
- **ID:** TL-2026-0339
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT35 (Iran)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-1708, CVE-2024-1709, CVE-2024-21893, CVE-2024-21887, CVE-2019-18935, CVE-2017-11317, CVE-2012-1823, CVE-2023-22527, CVE-2023-7028, CVE-2021-22205, CVE-2024-23897, CVE-2017-3506

## Description

APT35, also tracked as Charming Kitten, Phosphorus, Mint Sandstorm, TA453, Magic Hound, COBALT ILLUSION, and ITG18, is an Iranian state-sponsored cyber espionage group affiliated with the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). Active since at least 2011, the group has evolved from basic phishing operations into a sophisticated multi-division offensive cyber unit capable of long-term infrastructure compromise and intelligence preparation of the environment (IPE).

In a groundbreaking report published April 9, 2026, CloudSEK's TRIAD research team documented how APT35 systematically pre-positioned itself across critical infrastructure networks in Gulf Cooperation Council (GCC) nations over a multi-year campaign. This pre-positioning served a dual purpose: traditional espionage and — critically — the generation of targeting intelligence that directly supported Iran's kinetic military operations following Operation Epic Fury.

Operation Epic Fury, launched by the United States and Israel on February 28, 2026, struck Iranian nuclear infrastructure, ballistic missile production facilities, and IRGC compounds across 24 provinces. Iran responded with a multi-day ballistic missile and Shahed drone campaign targeting seven nations: Saudi Arabia, UAE, Kuwait, Bahrain, Qatar, Jordan, and Israel. CloudSEK's analysis reveals that APT35's pre-positioned access across these same nations provided critical targeting data — infrastructure maps, network topologies, and operational intelligence — that enabled precision targeting of critical facilities.

The campaign leveraged multiple attack vectors. APT35 exploited recently disclosed vulnerabilities in ConnectWise ScreenConnect (CVE-2024-1708/CVE-2024-1709), Ivanti Connect Secure (CVE-2024-21893/CVE-2024-21887), Telerik UI (CVE-2019-18935/CVE-2017-11317), PHP-CGI (CVE-2012-1823), and other enterprise platforms, often achieving exploitation within 48 hours of CVE disclosure. Their toolset included custom malware such as the RTM Project RAT (a modular Remote Access Trojan with Active Directory integration), WezRAT infostealer, and commodity tools including Nuclei, RouterScan, SQLMap, and Acunetix.

A late 2025 leak of APT35's internal operational documents by CloudSEK revealed a 17-member operational structure organized into four divisions: Operations Command, Project Managers, Specialized Operators, and Generic Operators. The leak exposed C2 infrastructure, operational playbooks, and evidence of massive data exfiltration — including 74 GB from a single Jordanian legal target and 6,911 emails from Afghan government ministries. Despite this exposure, APT35 rapidly refreshed infrastructure and remained operational.

Confirmed sub-campaigns include Operation Shattered Mirror (Israel, mass surveillance via compromised routers), Operation Desert Breach (Jordan, government and legal sector compromise), and Operation Swiftstrike (multi-country ConnectWise/Ivanti exploitation targeting Turkey, Saudi Arabia, Jordan, and UAE). The group's activities across GCC nations constitute the most significant documented case of cyber operations directly enabling kinetic military targeting, representing a paradigm shift in hybrid warfare.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1539 Steal Web Session Cookie
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1114 Email Collection
- T1056 Input Capture
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [CloudSEK: Kitten Had the Map All Along — Raising GCC Tensions & The Pre-Positioning Map](https://www.cloudsek.com/blog/kitten-had-the-map-all-along-raising-gcc-tensions-the-pre-positioning-map)
- [CloudSEK Full Research PDF: The Pre-Positioning Map](https://cdn.cloudsek.com/cloudsek-blog-pdfs/research-the-0ft.pdf)
- [CloudSEK: An Insider Look at the IRGC-linked APT35 Operations](https://www.cloudsek.com/blog/an-insider-look-at-the-irgc-linked-apt35-operations)
- [Gatewatcher: Data Breach — The Operations of Charming Kitten Revealed](https://www.gatewatcher.com/en/lab/data-breach-the-operations-of-charming-kitten-revealed/)
- [LevelBlue SpiderLabs: Operation Epic Fury — From Regional Escalation to Global Cyber Risk](https://www.levelblue.com/blogs/spiderlabs-blog/operation-epic-fury-from-regional-escalation-to-global-cyber-risk)
- [AttackIQ: Defending Against Iranian Cyber Threats in the Wake of Operation Epic Fury](https://www.attackiq.com/2026/03/05/operation-epic-fury/)
- [Tenable: Operation Epic Fury — Potential Iranian Cyber Counteroffensive Operations](https://www.tenable.com/blog/operation-epic-fury-potential-iranian-cyber-counteroffensive-operations)
- [Hunt.io: Iranian APT Infrastructure in Focus — Mapping State-Aligned Clusters](https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters)
- [MITRE ATT&CK: Magic Hound (G0059)](https://attack.mitre.org/groups/G0059/)
- [Darktrace: APT35 Charming Kitten Discovered in Pre-Infected Environment](https://www.darktrace.com/blog/apt35-charming-kitten-discovered-in-a-pre-infected-environment)
- [CISA Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [Malpedia: APT35 Threat Actor Profile](https://malpedia.caad.fkie.fraunhofer.de/actor/apt35)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0339