Iranian Hackers Masquerade as Journalists to Spy on Israel-Hamas War Experts

Mint Sandstorm (APT35) has conducted an active targeted espionage campaign since November 2023 against high-profile individuals working on Middle Eastern affairs across multiple countries, using tailored phishing lures, compromised legitimate accounts, and RAR-delivered payloads that deploy VB/PowerShell backdoors (MischiefTut and MediaPl). The group leverages resource-intensive social engineering, curl-based C2 communications, and custom implants designed for persistence and encrypted C2, reflecting an operationally mature, nation-state capability focused on intelligence collection related to the Israel–Hamas conflict.