Leaked Documents Reveal APT35’s Espionage Operations, Tooling and Victim Data

Oct 7, 2025 · Original article ↗

Summary

CloudSEK analyzes alleged internal APT35 documents describing phishing, rapid vulnerability exploitation, router manipulation, custom malware, EDR evasion, supply-chain attacks, and extensive data theft across government, legal, education, and other sectors.

Key points

CloudSEK says a dataset of more than 100 Persian-language documents appears to contain APT35 operational materials, including personnel records, campaign reports, and tooling details.
The documents describe rapid exploitation of ConnectWise CVE-2024-1709 and campaigns targeting routers and modems, including DNS manipulation across more than 580 devices.
Reported operations used phishing and credential harvesting, custom remote-access tools, Active Directory exploitation, and techniques to evade endpoint security.
The analysis describes long-term persistence and supply-chain pivots, including a reported compromise yielding more than 74 GB of data.
Reported targets span government, legal, education, finance, aviation, and energy sectors in the Middle East and other regions.
The article says the leak’s authenticity is supported by language, dates, working hours, targeting, infrastructure, and tradecraft that CloudSEK considers consistent with APT35.

Article Details

Attack Vectors: Exploitation of ConnectWise vulnerabilities CVE-2024-1708 and CVE-2024-1709, with the article reporting day-one exploitation of CVE-2024-1709.
Exploitation of Telerik vulnerabilities CVE-2019-18935 and CVE-2017-11317, PHP CGI vulnerability CVE-2012-1823, and Oracle WebLogic vulnerability CVE-2017-3506.
SQL injection, mass exploitation of routers and modems, and DNS manipulation on more than 580 devices.
Phishing and social-engineering campaigns, credential harvesting, and browser credential theft.
Web-shell deployment, domain-admin account creation, DLL hijacking, and obfuscated DLL payloads.
Active Directory exploitation, credential dumping, share-folder enumeration, and supply-chain pivoting through partner networks.
Compromise of backup infrastructure and extraction of databases, email archives, CCTV footage, and VoIP recordings.
Defensive Notes: The article describes exploitation of vulnerabilities shortly after disclosure; prioritize assessment and remediation of the listed ConnectWise, Telerik, PHP CGI, and Oracle WebLogic vulnerabilities.
Monitor for suspicious router or modem administration and DNS changes, web shells, newly created domain-admin accounts, obfuscated DLL payloads, and unusual Active Directory or shared-folder activity.
Review access to backup systems, cloud portals, email archives, and file-upload portals for unauthorized access or bulk data retrieval.
The article reports phishing infrastructure and credential harvesting; strengthen phishing resistance and investigate suspicious account activity and unexpected authentication challenges.

Indicators of compromise

Type	Indicator	Context
SHA1	`02120dcf3b263702028a0441881d339ee4ff8e15`	SHA-1 value cited as evidence for an APT35 operator's monthly report.
SHA1	`4037e9382a99fdd96fe93eb0fd4380eea695bd3a`	SHA-1 value cited as evidence for an APT35 operator's monthly report.
SHA1	`e8ed42d00168744e408dd53c795008c76ee788e6`	SHA-1 value cited as evidence for an APT35 infrastructure operator's monthly report.