APT35 PLAYS THE SAME MUSIC AGAIN

Summary from the TLDR InfoSec newsletter

Stormshield's CTI team discovered two previously unreported servers (84.200.193[.]20 and 79.132.131[.]184) linked to Iranian APT35 (Charming Kitten) by hunting for a distinctive HTML loading page pattern using ssdeep fuzzy hashing and queries in SilentPush and VirusTotal. The servers, active since July, host 49+ phishing domains impersonating video conferencing services, such as Google Meet, with typosquatting tactics (e.g., meet.go0gle[.]online), primarily targeting Israeli victims based on URL submission patterns. Defenders can track ongoing APT35 infrastructure using simple VirusTotal queries, such as "entity:url url:online/?invitation" or "entity:domain domain:viliam.*", to identify phishing domains that follow consistent naming conventions despite the campaign being publicly documented.