apt

Ballistic Bobcat

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

APT35APT42Charming KittenTA453PHOSPHORUSMint Sandstorm

Attribution

Iran — IRGC-aligned (Charming Kitten cluster)

Origin

Iran

First seen

2021

Last active

2024

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Israel (primary), broader Middle East

Sectors

Automotive, manufacturing, engineering, finance, media, healthcare, tech, telecom

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (primary), broader Middle East (Automotive, manufacturing, engineering sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Volatile CedaractorTechnique overlap
Scarred Manticore (Storm-0861)actorTechnique overlap
UNC1860actorTechnique overlap
BladedFelineactorTechnique overlap
Agrius (Agonizing Serpens / BlackShadow)actorTechnique overlap
RansomHouseactorTechnique overlap
MedusaactorTechnique overlap
Tropic TrooperactorTechnique overlap

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Uses

Obfuscated Files or InformationtechniqueATT&CK mapping
Exploit Public-Facing ApplicationtechniqueATT&CK mapping
Ingress Tool TransfertechniqueATT&CK mapping
Command and Scripting Interpreter: Windows Command ShelltechniqueATT&CK mapping
Server Software Component: Web ShelltechniqueATT&CK mapping
Create or Modify System Process: Windows ServicetechniqueATT&CK mapping
System Information DiscoverytechniqueATT&CK mapping