Kitten Had the Map all Along : RAISING GCC TENSIONS & THE PRE-POSITIONING MAP

1. SITUATION OVERVIEW

On February 28, 2026, the US and Israel launched Operation Epic Fury, destroying Iran’s nuclear infrastructure and killing Supreme Leader Khamenei. Iran’s internet was reduced to 4%. Iran retaliated with a multi-day ballistic missile and drone campaign striking seven countries simultaneously: Saudi Arabia, UAE, Kuwait, Bahrain, Qatar, Jordan, and Israel. The Strait of Hormuz is closed and the campaign is ongoing as of publication.

2. CENTRAL FINDING: CYBER RECONNAISSANCE PRECEDED KINETIC STRIKES

The KittenBusters disclosure (Sep–Oct 2025) provides insight into the reconnaissance activity that preceded the current strike campaign. Several of the countries targeted by Iranian strikes had previously been profiled or penetrated by APT35. The correlation between cyber targets and missile strike locations is systematic:

3. THE THREAT ACTOR: APT35 — NOW A UNIFIED IRGC PLATFORM

APT35 (also known as Charming Kitten, Phosphorus, Mint Sandstorm, Magic Hound) is attributed to the IRGC Intelligence Organization, Unit 1500, Department 40, commanded by Abbas Rahrovi through front company Zharf Andishaan Tafakkor Sefid. The KittenBusters leak confirms that two previously distinct personas — Moses-Staff (destructive wiper ops, Israel-focused) and Al-Qassam Cyber Fighters (DDoS, US/Israeli finance) — are funded from the same operational budget.

This means all prior Moses-Staff attacks must be re-attributed to IRGC-IO Dept. 40. Following the reported death of Khamenei and the ongoing regional escalation, The Moses-Staff persona may be reactivated for destructive operations if escalation continues.

4. ACTIVE CYBER OPERATIONS (AS OF MARCH 2, 2026)

5. KEY MALWARE IN PLAY

Episode 3 of the KittenBusters leak released APT35’s complete source code for its custom malware. Key tools now being deployed against GCC targets include BellaCiao (C#/.NET webshell with Windows service persistence, tested against Defender/Kaspersky/ESET), Sagheb RAT (native code FUD keylogger using TOR routing, steals Firefox and Telegram credentials), and the Python/Webshell Framework for managing multiple compromised hosts. The source code disclosure enables defenders to build precise YARA rules.

6. PRIORITY VULNERABILITIES EXPLOITED BY APT35

7. PRIORITY INDICATORS OF COMPROMISE (IOCS)

Domains to block immediately: dreamy-jobs.com (APT35 counterintelligence honeypot, confirmed by Google/Mandiant), gassam.su (Al-Qassam persona domain), aecars.store (phishing infrastructure), 1543.ir (internal VoIP).

Key IP ranges: 95.169.196.0/24 and 185.141.63.0/24 (operations hosting); 88.80.145.0/24 (C2 listener, file staging, SSH relay); 103.57.251.31 (anonymisation proxy).

Email indicators: Western-name ProtonMail personas at scale ([firstname].[lastname]@protonmail.com pattern). Verified active accounts include may.arnold@ and [email protected].

8. DEFENSIVE RECOMMENDATIONS

IMMEDIATE — Next 24 Hours

• Block all IOC domains and IP ranges listed above across perimeter firewalls and DNS.
• Emergency patching: ConnectWise ScreenConnect, ProxyShell (Exchange), Ivanti Connect Secure, Telerik. If patching is not possible, isolate systems.
• Hunt for Plink.exe execution in server environments (BellaCiao Variant 2 primary indicator) and Adminer.php / custom ASP/ASPX webshells on internet-facing servers.
• Rotate all Domain Administrator credentials. Audit admin accounts created since January 2024.
• If your organization operates in Jordan, UAE, or Saudi Arabia: initiate an immediate compromise assessment.

HIGH PRIORITY — Within 72 Hours

• Configure behavioral detection for Sagheb RAT: TOR circuit establishment from non-user processes; XOR-encrypted HTTP traffic.
• Audit SOHO/consumer router fleet (TP-LINK, ASUS, D-Link, Cisco RV) for DNS redirect behavior.
• Validate DDoS mitigation posture — Al-Qassam-pattern attacks on the financial sector are expected within days.
• Enforce MFA everywhere — Sagheb RAT specifically steals Telegram Desktop and Firefox credentials to bypass authentication.
• If using Sophos, Trend Micro, or SentinelOne: APT35 has documented AV bypass research against all three. Verify behavioral (not just signature-based) coverage is enabled.

‍
[Click Here To Download Full Research Paper]