Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
🇮🇷 IR15 malware families

BladedFeline

Also known asbladedfeline

BladedFeline is an Iran-aligned cyberespionage threat actor active since at least September 2017. ESET assesses with medium confidence that it is a sub-cluster of OilRig, also tracked as APT34 and Hazel Sandstorm, and reporting in the provided content describes OilRig as affiliated with Iran and commonly believed to be based there. BladedFeline has focused on long-term access and espionage against Kurdish and Iraqi government officials, including the Kurdistan Regional Government (KRG), and has also targeted Iraqi diplomatic officials, governmental organizations in Azerbaijan, and a regional telecommunications provider in Uzbekistan. The group was discovered after attacks against Kurdish diplomatic officials and has maintained illicit access to KRG-related victims for years. Reported victimology includes KRG officials compromised as early as 2017, high-ranking officials within the government of Iraq, and a telecom provider in Uzbekistan that may have been compromised as early as 2022 and later revisited. ESET reported the actor invested heavily in gathering diplomatic and financial information from Iraqi organizations. BladedFeline’s tooling includes multiple bespoke backdoors and persistence mechanisms. Named malware and implants in the provided content include Shahmaran, Whisper (also referred to as Veaty), Spearal, Optimizer, PrimeCache, Slippery Snakelet, Hawking Listener, P.S. Olala, Flog, Sheep Tunneler, and the reverse tunnels Laret and Pinar. Whisper is described as a C#/.NET backdoor that logs into compromised Microsoft Exchange webmail accounts and communicates with operators through encrypted email attachments. PrimeCache is a malicious IIS module and passive backdoor that receives commands via specially crafted HTTP cookie headers and supports command execution and file exfiltration. Shahmaran is a simple backdoor used for command execution and file and directory operations. Spearal uses DNS tunneling for command-and-control. Slippery Snakelet is a Python backdoor capable of command execution and file transfer. Laret and Pinar provide SSH-based reverse tunneling, and Flog is an ASPX web shell used for persistence. The content states the initial access vector into KRG victims is unclear, though ESET suspected exploitation of an internet-facing application in Iraqi government intrusions. Attribution to OilRig is supported in the content by victimology, the discovery of OilRig tools RDAT and VideoSRV on compromised KRG systems, and code similarities between PrimeCache and OilRig’s RDAT backdoor. Overall, the reported activity is consistent with sustained strategic espionage focused on maintaining and expanding access in Iraqi and neighboring regional targets.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Government & Administration
  • Telecommunication Services

Where they target

Geographies tied to known operations.

  • 🇮🇶 Iraq
  • 🇺🇿 Uzbekistan

Where they're from

Attributed origin per open-source reporting.

  • IR
MITRE ATT&CK

Tradecraft

30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics49 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1595
Active Scanning
T1595.002
Vulnerability Scanning
TA0042
Resource Development
2 techniques
T1583
Acquire Infrastructure
T1583.001
Domains
T1583.003
Virtual Private Server
T1586
Compromise Accounts
T1586.002×2
Email Accounts
TA0001
Initial Access
2 techniques
T1078
Valid Accounts
T1190
Exploit Public-Facing Application
TA0002
Execution
3 techniques
T1059
Command and Scripting Interpreter
T1059.001
PowerShell
T1059.003
Windows Command Shell
T1059.006
Python
T1059.007
JavaScript
T1559
Inter-Process Communication
T1569
System Services
T1569.002
Service Execution
TA0003
Persistence
4 techniques
T1078
Valid Accounts
T1505
Server Software Component
T1546
Event Triggered Execution
T1547
Boot or Logon Autostart Execution
T1547.001
Registry Run Keys / Startup Folder
TA0004
Privilege Escalation
4 techniques
T1055
Process Injection
T1078
Valid Accounts
T1546
Event Triggered Execution
T1547
Boot or Logon Autostart Execution
T1547.001
Registry Run Keys / Startup Folder
TA0005
Stealth
4 techniques
T1055
Process Injection
T1070
Indicator Removal
T1070.004
File Deletion
T1070.006
Timestomp
T1078
Valid Accounts
T1140
Deobfuscate/Decode Files or Information
TA0006
Credential Access
1 technique
T1003
OS Credential Dumping
T1003.001
LSASS Memory
TA0011
Command and Control
5 techniques
T1071
Application Layer Protocol
T1071.001
Web Protocols
T1071.003
Mail Protocols
T1090
Proxy
T1090.003
Multi-hop Proxy
T1105
Ingress Tool Transfer
T1132
Data Encoding
T1132.001
Standard Encoding
T1573
Encrypted Channel
T1573.001
Symmetric Cryptography
T1573.002
Asymmetric Cryptography
TA0010
Exfiltration
2 techniques
T1041×2
Exfiltration Over C2 Channel
T1048
Exfiltration Over Alternative Protocol
T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol
IOCS

Observables

9 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping30

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal15

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables9

Domains, IPs, and hashes tied to this actor, refreshed continuously.