apt

BladedFeline

active · last signal 10mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Veaty (internal PDB string reference)

Attribution

Iran-nexus cyberespionage group. ESET assesses with MEDIUM confidence that BladedFeline is a subgroup within, or closely related to, OilRig (APT34) / Lyceum, based on shared tooling (VideoSRV, RDAT), code similarities in the PrimeCache and RDAT backdoors, and overlapping targeting. Attribution and OilRig linkage rest on essentially single-vendor (ESET) reporting; overall attribution confidence: medium.

Origin

Iran

First seen

2017

Last active

2024

Motivation

Espionage (state-nexus cyberespionage: long-term intelligence collection and persistent access against government and diplomatic targets)

Attribution confidence

medium

MENA targeting

Iraq (incl. Kurdistan Regional Government)

Sectors

Government, diplomatic officials, telecom

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iraq (incl. Kurdistan Regional Government) (Government, diplomatic officials, telecom sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BellaCiao operators (Charming Kitten-linked)actorTechnique overlap
WarlockactorTechnique overlap
UNC215actorTechnique overlap
Ballistic BobcatactorTechnique overlap
Nemesis KittenactorTechnique overlap
StrongPity (PROMETHIUM)actorTechnique overlap
UNC1860actorTechnique overlap
Agrius (Agonizing Serpens / BlackShadow)actorTechnique overlap

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Uses

Application Layer Protocol: Mail ProtocolstechniqueATT&CK mapping
Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 ProtocoltechniqueATT&CK mapping
User Execution: Malicious FiletechniqueATT&CK mapping
Create or Modify System Process: Windows ServicetechniqueATT&CK mapping
Server Software Component: Web ShelltechniqueATT&CK mapping
OS Credential Dumping: LSASS MemorytechniqueATT&CK mapping
Protocol TunnelingtechniqueATT&CK mapping
Application Layer Protocol: DNStechniqueATT&CK mapping
Indicator Removal: TimestomptechniqueATT&CK mapping