APT35 (Charming Kitten)

What APT35 Means in Practice

APT35, also known as charming kitten, is best understood as a persistent phishing and account-compromise threat. The group’s value to defenders is not just the label, but the repeatable pattern: social lures, credential theft, mailbox abuse and access that blends into normal user activity.

Because the group is associated with intelligence-driven targeting, the practical question is often less “who are they?” and more “what access did they gain, and how far did it spread?” That makes campaign tracing, mailbox review and identity-centric investigation central to understanding the term.

Why This Group Matters to Defenders

APT35-style operations are dangerous because they often begin with ordinary-looking emails and end with durable access. Once credentials or tokens are captured, attackers can pivot into mailboxes, password reset flows and connected applications without immediately triggering obvious malware detections.

The main defensive challenge is that these compromises can look legitimate from the perspective of the target system. A successful login, an OAuth grant or a mailbox rule may be an attacker action that appears to the platform as normal user behaviour.

Common Attack Patterns Associated with APT35

The group is commonly linked to impersonation, credential harvesting, session theft and follow-on account takeover. In practice, that means defenders should pay attention to brand impersonation, urgent account prompts, fake login portals and messages designed to trigger a password reset or consent grant.

Mailbox-centric abuse is especially important because access to email can unlock other services. If a threat actor can read messages, search for reset links, approve risky prompts or create forwarding rules, they may sustain access even after an initial password change.

For a useful overview of how threat actor naming, campaign clustering and aliasing work, see the Threat Actor Groups Guide.

How to Investigate and Reduce Exposure

Exposure checks should start with user inventory, email protection and recent sign-in review. Look for suspicious inbox rules, unusual OAuth consent events, impossible travel, legacy authentication use, and alerts from the identity provider or mail platform that indicate account misuse.

Mitigation is strongest when phishing-resistant MFA is paired with tight mail filtering, limited consent permissions and fast review of anomalous sign-ins. When compromise is suspected, treat the mailbox as a control point, not just a communications tool, because it may reveal persistence, lateral movement and secondary targets.

Defenders should map these behaviours to adversary tradecraft in the MITRE ATT&CK Enterprise Matrix and use phishing-resistant authentication guidance from NIST SP 800-63 Digital Identity Guidelines when reviewing sign-in protections.

Risk and Threat Considerations

APT35 is especially risky because the campaign path often starts with human trust and ends with control over identity-bearing systems such as email and federated accounts. That gives the operator a quiet way to persist, impersonate the victim and search for further access opportunities.

Failure mechanism: The attacker steals credentials or session access through phishing, then abuses mailbox or account trust to reset passwords, approve prompts, create forwarding rules or reach connected services.

Impact: The result can be account takeover, message exposure, identity impersonation and wider compromise of the victim’s connected business or intelligence-related accounts.

Practitioner Guidance

What to watch for: Treat mailbox rules, OAuth grants and password reset activity as high-signal investigation points when they appear alongside sign-in anomalies or suspicious lures. The presence of these events often means the compromise has moved beyond a single phishing click.

Governance implication: Response ownership should sit with identity, messaging and incident response teams together, because the threat crosses mail, authentication and account recovery boundaries. If the compromise is confirmed, rotate affected credentials and review all sessions and delegated access linked to the account.

Related resources from NHI Mgmt Group

• What tactics and techniques does Charming Kitten use?
• How can organisations defend against Charming Kitten?
• Charming Kitten
• What tactics and techniques does Ferocious Kitten use?