CampaignPublished 6 Jun 2025

BladedFeline: Whispering in the dark

Source AlienVault OTX General

Description

ESET researchers have uncovered a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has been targeting Kurdish and Iraqi government officials since at least 2017, using various malicious tools including reverse tunnels, backdoors, and a malicious IIS module. Key malware includes the Whisper backdoor, which communicates via compromised email accounts, and PrimeCache, a malicious IIS module with similarities to OilRig's RDAT backdoor. The campaign also targeted a telecommunications provider in Uzbekistan. BladedFeline's sophisticated tactics and tools indicate a focus on maintaining strategic access to high-ranking officials for espionage purposes.

Impact

For European organizations, the direct impact of BladedFeline is currently limited due to its regional focus on Middle Eastern government and telecommunications sectors. However, European entities with strategic partnerships, diplomatic ties, or business interests in the Middle East—especially in energy, telecommunications, or government affairs—may face collateral risks such as supply chain compromises or indirect targeting. Organizations operating IIS web servers or managing email infrastructure could be vulnerable to stealthy backdoors and covert C2 channels similar to those used by BladedFeline. If the group expands its targeting scope or if other threat actors adopt similar tactics, European organizations could experience espionage risks including sensitive data exfiltration, credential theft, and long-term network persistence. The campaign’s sophisticated use of reverse tunnels and modular malware complicates detection and incident response, increasing the risk of prolonged undetected intrusions. The primary concern is confidentiality breaches of sensitive government or corporate information, with potential secondary impacts on data integrity and availability if attackers choose to disrupt or manipulate services.

Defensive guidance

European organizations should implement targeted defenses beyond generic best practices. Specifically, entities running IIS web servers must conduct thorough audits and continuous monitoring for unauthorized or suspicious IIS modules, utilizing file integrity monitoring and anomaly detection to identify malicious components like PrimeCache. Email infrastructure should be hardened by enforcing multi-factor authentication (MFA), monitoring for unusual login patterns, and deploying advanced threat protection solutions to detect compromised accounts used for covert C2 communications. Network segmentation should be employed to isolate critical web and email servers, limiting lateral movement opportunities for attackers. Deploying network traffic analysis tools capable of detecting covert channels, such as anomalous email traffic or reverse tunnels, will enhance early detection capabilities. Regular threat hunting exercises focused on TTPs associated with BladedFeline—including credential dumping, persistence, and command execution techniques—will improve incident response readiness. Patch management should prioritize known IIS vulnerabilities to reduce the attack surface, even though no specific exploits are currently reported. Finally, active sharing of threat intelligence with regional and sector-specific Information Sharing and Analysis Centers (ISACs) will strengthen collective defense against evolving espionage campaigns.

Indicators of compromise

Domains 4

domain.computer
olinpa.com
zaincell.store
dropper.agent.gi

Hashes 3

4cc88ce123b0da8d75c0fe66a39339f6
562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d
be0ad25b7b48347984908175404996531cfd74b7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Jul 2025, 11:10 UTC

MITRE ATT&CK techniques26 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 3

Community reviews

Related threats