cyber.hendryadrian.com
Threat Research · dti.domaintools.com

Leaked APT35 Records Link Infrastructure Procurement to Moses Staff Operations

· Original article ↗

Summary

Analysis of leaked spreadsheets, payment records, and infrastructure data links APT35 procurement practices to Moses Staff, while exposing credentials and operational details left accessible after the leak.

Key points

  • The article analyzes three leaked spreadsheets documenting services, Bitcoin payments, and network infrastructure used in APT35 operations.
  • The records contain more than 80 cleartext credential pairs and over 50 ProtonMail identities, according to the article.
  • Service records and payment entries link domain and VPS procurement to recurring providers and crypto-payment activity.
  • The analysis connects Moses Staff domains and accounts to infrastructure records associated with APT35, arguing the groups shared operational logistics.
  • The article describes job-themed domains and phishing infrastructure aimed at credential theft, alongside Moses Staff leak and defacement activity.
  • APT35 reportedly left operational infrastructure and service credentials accessible for weeks after the leak.

Article Details

Attack Vectors
  • Job-themed and other branded phishing pages on rented infrastructure were used to harvest credentials.
  • The article describes credential harvesting followed by attempts to use the harvested credentials for further access.
  • Moses Staff operations included public data leaks and defacements targeting Israeli organizations.

Indicators of compromise

TypeIndicatorContext
DOMAINbbmovements[.]comDomain associated in the article with Iranian influence operations and listed as operational infrastructure.
DOMAINcavinet[.]orgListed among the APT35 operational domains.
DOMAINdreamy-jobs[.]comOperational domain described as a job-themed credential-harvesting lure.
DOMAINisrael-talent[.]comOperational domain described as an employment-themed lure targeting Israeli organizations.
DOMAINisrael-talent[.]xyzOperational domain described as an employment-themed lure targeting Israeli organizations.
DOMAINkanplus[.]orgListed among operational domains and described as internal-use infrastructure.
DOMAINmisvps[.]ioDomain described as procured and activated as infrastructure for Charming Kitten and Moses Staff campaigns.
DOMAINmoses-staff[.]ioMoses Staff leak and propaganda infrastructure.
DOMAINmoses-staff[.]seMoses Staff leak and propaganda infrastructure.
DOMAINmoses-staff[.]toMoses Staff leak and propaganda infrastructure.
DOMAINsecnetdc[.]comHosting entry paired with a Bitcoin payment artifact in the operational records.
DOMAINsskmt[.]comDomain described as procured and activated as infrastructure for Charming Kitten and Moses Staff campaigns.
DOMAINtecret[.]comListed among operational domains and described as internal-use infrastructure.
DOMAINtermite[.]nuListed among operational domains and described as internal-use infrastructure.
DOMAINwazayif-halima[.]orgOperational domain described as a job-themed lure for spear-phishing.
EMAILb[.]laws32@proton[.]meEmail identity listed among operational procurement accounts.
EMAILbashiriansul@proton[.]meEmail identity listed among operational procurement accounts.
EMAILbbmovement@protonmail[.]comOperational email identity appearing in Charming Kitten correspondence and hosting records associated with Moses Staff domains.
EMAILcarlos[.]patel@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILclark[.]norman@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILcou[.]nic@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILcybersonix@protonmail[.]comOperational email identity appearing in Charming Kitten correspondence and hosting records associated with Moses Staff domains.
EMAILgdavies007@proton[.]meEmail identity listed among operational procurement accounts.
EMAILjhjbmuugtfftdd@proton[.]meEmail identity listed among operational procurement accounts.
EMAILjohn[.]porter857@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILjuliusyermolayev@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILlolita259@proton[.]meEmail identity listed among operational procurement accounts.
EMAILmekhaeelkalashnikova@proton[.]meEmail identity listed among operational procurement accounts.
EMAILmeriyalee@protonmail[.]comOperational email identity appearing in Charming Kitten correspondence and hosting records associated with Moses Staff domains.
EMAILmlw[.]services[.]313@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILmolden5@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILnansi[.]morad@protonmail[.]comEmail identity listed among operational procurement accounts.
EMAILrona_yanga@proton[.]meEmail identity listed among operational procurement accounts.
EMAILsanjilankopylova@proton[.]meEmail identity listed among operational procurement accounts.
EMAILshirley7070@proton[.]meEmail identity listed among operational procurement accounts.
EMAILtimothyefimov@protonmail[.]comEmail identity listed among operational procurement accounts.
IPV4195[.]191[.]44[.]73IP address listed in the network sheet among addresses associated with the operators' live infrastructure.

MITRE ATT&CK

T1036 · MasqueradingOperators used fabricated identities and job-themed domains to make procurement and phishing infrastructure appear legitimate.T1056.003 · Web Portal CaptureCredential-harvesting login portals were deployed on operator-controlled domains.T1071.001 · Web ProtocolsThe article identifies HTTP(S) as the protocol used by C2 nodes hosted on VPS servers.T1078 · Valid AccountsThe article says harvested credentials were used in further access attempts.T1491 · DefacementMoses Staff used public defacements to intimidate Israeli institutions.T1566 · PhishingThe article describes phishing pages and job-themed lures used to obtain credentials.T1567.002 · Exfiltration to Cloud StorageThe article describes Moses Staff leak sites as channels for publishing stolen data.T1583.001 · DomainsThe article describes registering campaign and operational domains.T1583.003 · Virtual Private ServerThe article describes routinely acquiring VPS infrastructure from hosting resellers.T1585.001 · Social Media AccountsThe operators created single-use email accounts for procurement identities.T1598 · Phishing for InformationJob-themed lures and credential-harvesting pages were used to solicit victims' credentials.

Threat Actors

Charming KittenThe article identifies Charming Kitten as another name for APT35.Moses StaffThreat group described as conducting destructive intrusions, data leaks, and defacements; the article links its infrastructure administration to APT35.RICH IONIran-linked threat actor described as operating credential-phishing campaigns and the infrastructure associated with Moses Staff.

Malware

StrifeWaterfirms, public data dumps, the sudden appearance of custom toolsets like PyDcrypt, DCSrv, and the later StrifeWater RAT. Analysts saw ideology and chaos; what they lacked, until this dump, was administration.

Vendors

Cryptomusspreadsheets logging hosting providers and invoice numbers, crypto receipts processed through Cryptomus, and server rentals under a mosaic of false European identities. These aren’t exploits, they’re expenseEDIS Globalevents but templated cycles aligned with the rows preserved in the service ledger. The repeated use of EDIS Global in Cyprus as a hosting provider, combined with Cryptomus as the payment conduit, reveals a supply chainImpreza Hostact as anonymized intermediaries; small-scale European VPS resellers such as EDIS Global and Impreza Host become unwitting facilitators; and administrative ledgers track every euro spent as if it were aNamecheapappears ~20 times, NameSilo (cheap domains) ~14, and Impreza (VPS) ~6, alongside sporadic mentions of Namecheap (domains) and Temok (Domains). The net effect is a normalized procurement sheet for intrusion, domains,NameSiloProvider references are recurrent and standardized rather than ad-hoc: EDIS (VPS) appears ~20 times, NameSilo (cheap domains) ~14, and Impreza (VPS) ~6, alongside sporadic mentions of Namecheap (domains) and TemokNowPaymentsby sanctions, operators have built a parallel economy of intrusion: crypto gateways like Cryptomus and NowPayments act as anonymized intermediaries; small-scale European VPS resellers such as EDIS Global and ImprezaProtonMailroughly 170 populated rows tying domains to registrars and service notes, plus more than 50 distinct ProtonMail identities and over 80 cleartext credential pairs in email:password format. The entries include cadenceTemok(cheap domains) ~14, and Impreza (VPS) ~6, alongside sporadic mentions of Namecheap (domains) and Temok (Domains). The net effect is a normalized procurement sheet for intrusion, domains, tenancies, andTheOnionHostin the hosting ledgers that birthed Moses Staff domains. The same registrars recur, modernizmir.net, TheOnionHost, Namecheap. The same payment conduit repeats, crypto micropayments through Cryptomus routed via Cyprus.

Tools

DCSrvIsraeli logistics firms, public data dumps, the sudden appearance of custom toolsets like PyDcrypt, DCSrv, and the later StrifeWater RAT. Analysts saw ideology and chaos; what they lacked, until this dump, wasPyDcryptagainst Israeli logistics firms, public data dumps, the sudden appearance of custom toolsets like PyDcrypt, DCSrv, and the later StrifeWater RAT. Analysts saw ideology and chaos; what they lacked, until this

Countries

BulgariaThe final layer consists of remnants of project-coded infrastructure, Abrahams Ax, kashef, and Bulgaria-based servers, that appear in the operators’ internal notes as hostnames, VPN exit nodes, or C2 pivots. While notCyprusno visible treasury trails, only the steady drip of crypto micro-payments routed through resellers in Cyprus, the Netherlands, and Central Europe. Each one buys continuity, not capability: another month of hostingIranlive servers, and even hosting and service passwords accessible for weeks. The supposed guardians of Iran’s cyber doctrine simply walked away from their own compromised backend. This lack of operational hygieneIsraelMoses Staff represents not just a hacking group but a psychological weapon forged for the long war with Israel, a digital insurgency cloaked in ideology and bureaucracy. Between 2021 and 2025, the group’s victim setNetherlandstreasury trails, only the steady drip of crypto micro-payments routed through resellers in Cyprus, the Netherlands, and Central Europe. Each one buys continuity, not capability: another month of hosting for a phishing

Industries

Defensethe loud ones, constantly deploying new credential-harvesting pages dressed in Western university or defense-contractor branding, yet always recycling the same code and lures. For years, analysts dismissed them asElectric utilitiesGovernmentSeen through this lens, APT35 functions as a government department more than a hacker crew. Someone drafts a VPS requisition; another logs the cost in euros; a supervisor approves the line item; and only then does aInformation TechnologyLegalrails effectively launder state funding into operational liquidity, while European resellers provide the legal and infrastructural scaffolding that make Tehran’s influence operations indistinguishable from ordinary

Related Articles