Threat actor profile
A source-linked view of reported activity, targets and related automated campaign clusters.
Background and history
APT35 is an Iran-linked espionage group associated in public reporting with operations against government, defence, academia, media, technology and civil-society targets. The group is well known for social engineering and credential-focused campaigns that use convincing personas, relationship building and phishing infrastructure.
Activity has been reported since at least the 2010s under names including Charming Kitten and Mint Sandstorm. Campaigns frequently reflect Iranian strategic interests, but individual vendor names may cover different slices of the wider activity. The recurring lesson is that apparently personal contact can be an operational access route.
Known aliases
APT35Charming KittenMint Sandstorm
Google Threat Intelligence Group · 24 Jul 2026
Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…
