APT35 pioneered the long-con credential theft model that APT42 later refined. The attack starts not with a link or an attachment, but with a relationship. An operator creates a convincing persona: a journalist from a Western outlet, a researcher at a think tank, an organizer for an academic conference. They reach out to the target via email, LinkedIn, or Twitter with a legitimate-seeming request: an interview, a speaking invitation, a collaboration proposal.

The correspondence continues for days or weeks. The persona builds credibility by sharing genuine articles, referencing real events, and demonstrating knowledge of the target's work. Only after trust is established does the attack materialize: a shared Google Doc that requires login (credential harvesting page), a conference registration form (fake portal), or a document that requires downloading from a cloud link (malware delivery).

This patient social engineering is why APT35 is effective against high-value individuals who are trained to spot phishing. The lure doesn't look like phishing. It looks like a professional opportunity from someone you've been corresponding with for two weeks.

Credential harvesting infrastructure. APT35 builds convincing login pages mimicking Google, Microsoft, Yahoo, university SSO, and webmail providers. Domains use SSO-related keywords combined with target-organization names. Infrastructure rotates every 1-2 months. Recent shift from hyphenated domains (sso-target.com) to subdomain patterns (sso.target.com).

Exploitation. CVE-2023-38831 (WinRAR) used in credential harvesting campaigns. CVE-2022-47966 (Zoho ManageEngine) for initial access. Log4Shell (CVE-2021-44228) exploited for enterprise network intrusion. ProxyShell/ProxyLogon (Exchange) for email access. When social engineering doesn't work, they exploit.

Post-compromise. Once inside an email account: harvest the contact list for additional targeting, search for sensitive communications, set up forwarding rules to maintain access, and pivot to cloud storage (OneDrive, Google Drive) linked to the account. The compromised email is both an intelligence source and a launch platform for targeting the victim's contacts.

Fox Kitten / Lemon Sandstorm crossover. APT35 overlaps with Fox Kitten (PARISITE) operations that exploit VPN and edge devices (Citrix, F5, Pulse Secure, Fortinet) for initial access. FBI/CISA confirmed Fox Kitten selling network access to ransomware affiliates (NoEscape, RansomHouse, ALPHV). The line between APT35 espionage and Fox Kitten access brokering is blurred, with shared infrastructure and tooling.

1. 1. Search for relationship-based phishing correspondence Check email logs for multi-message threads with unknown external contacts that preceded a link click or document download. The pattern: 3+ messages exchanged before any link or attachment appears. The sender claims to be a journalist, researcher, think tank analyst, or conference organizer. Contact information doesn't verify against the claimed organization's real staff directory. Email gateway: multi-message thread analysis · Sender domain WHOIS/age check
2. 2. Check for credential harvesting page visits Search proxy logs for visits to recently registered domains containing keywords: "login," "signin," "auth," "verify," "account," "security," "webmail," combined with the target's organization name or a mimicked cloud provider. Also check for AiTM proxy indicators (Evilginx-style) where the URL structure proxies a legitimate login page. Compromised Credentials playbook · Proxy logs · Domain age analysis
3. 3. Audit email forwarding rules on high-value accounts APT35 sets up forwarding rules to maintain persistent access to compromised mailboxes. Check for: rules forwarding to external freemail addresses, rules that delete or move specific messages, and rules created during or shortly after credential compromise. Use Get-InboxRule across all executive, policy, and communications staff mailboxes. BEC playbook · Exchange: Get-InboxRule · M365 UAL: New-InboxRule
4. 4. Check for VPN/edge device exploitation (Fox Kitten crossover) If you run Citrix NetScaler, F5 BIG-IP, Pulse Secure/Ivanti, PanOS, or Fortinet: check for exploitation indicators during vulnerability windows. Fox Kitten/PARISITE rapidly exploits these devices and either conducts espionage or sells the access to ransomware groups. The same infrastructure that serves APT35 espionage serves Fox Kitten access brokering. Edge Device playbook · FBI/CISA AA24-241A
5. 5. Check for cloud account compromise indicators After credential theft, APT35 accesses cloud services linked to the compromised account. Check for: unusual sign-ins to Google Workspace, M365, or OneDrive from new IPs, bulk file downloads from cloud storage, OAuth app consent grants from compromised accounts, and new device enrollments. Hybrid AD playbook · Cloud sign-in logs · OAuth consent audit
6. 6. Verify whether compromised accounts were used to target contacts A compromised APT35 account becomes a trusted launchpad. Check sent items for: outbound messages to the victim's contact list containing links or documents, messages impersonating the victim to their professional network, and correspondence that continues the catfishing pattern (building relationships with the victim's contacts before delivering lures). Email gateway: outbound analysis from compromised account · Message trace

APT35 and APT42 were originally tracked as one group. Mandiant split APT42 out in 2022, identifying distinct operational mandates. The distinction matters for defenders:

APT35 focuses on political espionage at organizational scale. They target government agencies, defense contractors, media organizations, and NGOs. Their credential theft feeds intelligence collection against institutions. They also cross over into exploitation (VPN/edge devices, Exchange) and have a documented connection to the Fox Kitten ransomware IAB operation.

APT42 focuses on surveillance of specific individuals. They target dissidents, activists, journalists, and academics as people, not as employees of organizations. Their operations include mobile spyware and cloud-based tracking. The intelligence objective is monitoring what an individual says and does, not what their organization knows.

In practice, the groups share infrastructure, tooling, and social engineering methodology. Microsoft tracks both under the composite name "Mint Sandstorm." If you're investigating Iranian credential theft, both playbooks apply.

APT42 (individual surveillance, split from APT35)
MuddyWater (MOIS, different agency, PowerShell-focused)
Compromised Credentials (APT35's entire model)
Edge Device Compromised (Fox Kitten crossover)