Exploit-DB RSS Feed

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ESET researchers uncovered a cyberespionage campaign by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has targeted Kurdish and Iraqi government officials since at least 2017, using various malicious tools including the Whisper backdoor, PrimeCache IIS module, and reverse tunnels. BladedFeline maintains persistent access to high-ranking officials in both the Kurdistan Regional Government and Iraqi government, likely for espionage purposes. The group's toolset includes sophisticated backdoors, webshells, and custom tunneling applications. ESET assesses with medium confidence that BladedFeline is a subgroup of OilRig, based on shared code, targets, and tactics. The campaign also extended to a telecommunications provider in Uzbekistan.

The 'Whispering in the dark' campaign is a cyberespionage operation attributed to BladedFeline, an Iran-aligned advanced persistent threat (APT) group likely linked to the OilRig threat actor. Active since at least 2017, BladedFeline has targeted high-ranking officials within the Kurdistan Regional Government and the Iraqi government, as well as a telecommunications provider in Uzbekistan. The group employs a sophisticated and diverse toolset including the Whisper backdoor, PrimeCache IIS module, custom reverse tunneling applications, webshells, and other malware components. These tools enable persistent access, stealthy lateral movement, and data exfiltration. The use of IIS modules and reverse tunnels suggests exploitation of web infrastructure to maintain covert communication channels. ESET researchers have identified shared code, tactics, and targeting patterns linking BladedFeline to OilRig, reinforcing the attribution. The campaign's focus on government officials and critical infrastructure indicates a strategic espionage objective, likely to gather sensitive political, military, or economic intelligence. The technical sophistication and persistence of the group demonstrate a well-resourced adversary capable of evading detection and maintaining long-term access to high-value targets.

MD5 of 6973d3ff8852a3292380b07858d43d0b80c0616e

MD5 of f28d8c5c2283019e6ed788d20240abc8554cadb5

MD5 of be0ad25b7b48347984908175404996531cfd74b7

MD5 of 1c757accbc2755e83e530dda11b3f81007325e67

MD5 of 66bd8db40f4169c7f0fca3d5d15c978efe143cf8

MD5 of 272cf34e8db2078a3170cf0e54255d89785e3c50

MD5 of 01b99ff47ec6394753f9ccdd2d43b3e804f9ee36

MD5 of bb4ffcdbfad40125080c13fa4917a1e836a8d101

MD5 of 37859e94086ec47b3665328e9c9baf665cb869f6

SHA256 of 6973d3ff8852a3292380b07858d43d0b80c0616e

SHA256 of f28d8c5c2283019e6ed788d20240abc8554cadb5

SHA256 of 37859e94086ec47b3665328e9c9baf665cb869f6

SHA256 of 66bd8db40f4169c7f0fca3d5d15c978efe143cf8

SHA256 of bb4ffcdbfad40125080c13fa4917a1e836a8d101

SHA256 of 272cf34e8db2078a3170cf0e54255d89785e3c50

SHA256 of 01b99ff47ec6394753f9ccdd2d43b3e804f9ee36

SHA256 of 1c757accbc2755e83e530dda11b3f81007325e67

Detailed information about Whispering in the dark. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'reverse tunnel'

Filter Threats

Threats Tagged 'reverse tunnel'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility