Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ESET researchers uncovered a cyberespionage campaign by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has targeted Kurdish and Iraqi government officials since at least 2017, using various malicious tools including the Whisper backdoor, PrimeCache IIS module, and reverse tunnels. BladedFeline maintains persistent access to high-ranking officials in both the Kurdistan Regional Government and Iraqi government, likely for espionage purposes. The group's toolset includes sophisticated backdoors, webshells, and custom tunneling applications. ESET assesses with medium confidence that BladedFeline is a subgroup of OilRig, based on shared code, targets, and tactics. The campaign also extended to a telecommunications provider in Uzbekistan.

The 'Whispering in the dark' campaign is a cyberespionage operation attributed to BladedFeline, an Iran-aligned advanced persistent threat (APT) group likely linked to the OilRig threat actor. Active since at least 2017, BladedFeline has targeted high-ranking officials within the Kurdistan Regional Government and the Iraqi government, as well as a telecommunications provider in Uzbekistan. The group employs a sophisticated and diverse toolset including the Whisper backdoor, PrimeCache IIS module, custom reverse tunneling applications, webshells, and other malware components. These tools enable persistent access, stealthy lateral movement, and data exfiltration. The use of IIS modules and reverse tunnels suggests exploitation of web infrastructure to maintain covert communication channels. ESET researchers have identified shared code, tactics, and targeting patterns linking BladedFeline to OilRig, reinforcing the attribution. The campaign's focus on government officials and critical infrastructure indicates a strategic espionage objective, likely to gather sensitive political, military, or economic intelligence. The technical sophistication and persistence of the group demonstrate a well-resourced adversary capable of evading detection and maintaining long-term access to high-value targets.

MD5 of 6973d3ff8852a3292380b07858d43d0b80c0616e

MD5 of f28d8c5c2283019e6ed788d20240abc8554cadb5

MD5 of be0ad25b7b48347984908175404996531cfd74b7

MD5 of 1c757accbc2755e83e530dda11b3f81007325e67

MD5 of 66bd8db40f4169c7f0fca3d5d15c978efe143cf8

MD5 of 272cf34e8db2078a3170cf0e54255d89785e3c50

MD5 of 01b99ff47ec6394753f9ccdd2d43b3e804f9ee36

MD5 of bb4ffcdbfad40125080c13fa4917a1e836a8d101

MD5 of 37859e94086ec47b3665328e9c9baf665cb869f6

SHA256 of 6973d3ff8852a3292380b07858d43d0b80c0616e

SHA256 of f28d8c5c2283019e6ed788d20240abc8554cadb5

SHA256 of 37859e94086ec47b3665328e9c9baf665cb869f6

SHA256 of 66bd8db40f4169c7f0fca3d5d15c978efe143cf8

SHA256 of bb4ffcdbfad40125080c13fa4917a1e836a8d101

SHA256 of 272cf34e8db2078a3170cf0e54255d89785e3c50

SHA256 of 01b99ff47ec6394753f9ccdd2d43b3e804f9ee36

SHA256 of 1c757accbc2755e83e530dda11b3f81007325e67

Detailed information about Whispering in the dark. Get real-time updates, technical details, and mitigation strategies.

Whispering in the dark - Live Threat Intelligence - Threat Radar | OffSeq.com

Whispering in the dark

ESET researchers have uncovered a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has been targeting Kurdish and Iraqi government officials since at least 2017, using various malicious tools including reverse tunnels, backdoors, and a malicious IIS module. Key malware includes the Whisper backdoor, which communicates via compromised email accounts, and PrimeCache, a malicious IIS module with similarities to OilRig's RDAT backdoor. The campaign also targeted a telecommunications provider in Uzbekistan. BladedFeline's sophisticated tactics and tools indicate a focus on maintaining strategic access to high-ranking officials for espionage purposes.

BladedFeline is an advanced persistent threat (APT) group aligned with Iranian interests, likely connected to the OilRig threat actor. This group has been conducting a cyberespionage campaign since at least 2017, primarily targeting Kurdish and Iraqi government officials, as well as a telecommunications provider in Uzbekistan. The campaign employs a sophisticated toolkit that includes reverse tunnels, backdoors, and a malicious IIS (Internet Information Services) module named PrimeCache. PrimeCache shares code similarities with OilRig's RDAT backdoor, indicating possible shared development or code reuse among Iran-aligned groups. A key malware component is the Whisper backdoor, which stealthily communicates via compromised email accounts, enabling covert command and control (C2) channels that evade traditional network monitoring. The campaign leverages multiple MITRE ATT&CK techniques such as credential dumping (T1003.001), command execution via PowerShell and other scripting languages (T1059.001, T1059.007), exploitation of IIS vulnerabilities (T1190), and persistence mechanisms (T1547.001, T1546). The use of malicious IIS modules allows attackers to maintain a foothold on web servers, intercept or manipulate web traffic, and pivot within victim networks. The campaign’s focus on high-ranking officials and critical infrastructure underscores its strategic espionage intent rather than financial gain. Indicators of compromise include specific malware hashes and suspicious domains used for C2 communications. Although no known public exploits are currently reported, the campaign’s longevity and tool sophistication demonstrate a well-resourced adversary capable of stealthy, persistent access and evasion of detection through modular malware and covert communication channels.

Detailed information about BladedFeline: Whispering in the dark. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'slippery snakelet'

Filter Threats

Threats Tagged 'slippery snakelet'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility