APT35 is a threat actor attributed to IR, also known as UNC788, ITG-018, TA455. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does APT35 exploit?

APT35 is known to exploit 12 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

APT35

Also known as: UNC788, ITG-018, TA455, Group 83, Newscaster, APT35, Cobalt Mirage, TA453, COBALT ILLUSION, Newscaster Team, Yellow Garuda, Tarh Andishan, Ballistic Bobcat, Timberworm, Magic Hound, COBALT MIRAGE, Agent Serpens, Mint Sandstorm, CHARMING KITTEN, NewsBeef, TunnelVision, Parastoo, TEMP.Beanie, G0059, iKittens, PHOSPHORUS, Cobalt Illusion, CALANQUE, Educated Manticore, ITG18, G0058, Phosphorus, APT 35, CharmingCypress, Charming Kitten

IRInformation theft and espionage

Exploited CVEs

Overview

FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored by the Iranian government that conducts long term, resource-intensive operations to collect strategic intelligence. APT35 typically targets U.S. and the Middle Eastern military, diplomatic and government personnel, organizations in the media, energy and defense industrial base (DIB), and engineering, business services and telecommunications sectors.

Exploited Vulnerabilities

CVE ID	Action
CVE-2018-13379	View Details