Loading malware…
BellaCiao is a malware family publicly associated with the Iranian espionage actor Charming Kitten, also tracked as APT35, Mint Sandstorm, and PHOSPHORUS. It is best characterized as a tailored Windows dropper and implant framework used in targeted intrusions, particularly against Microsoft Exchange servers and IIS-hosted environments. The malware has been observed in victim-specific builds containing hardcoded organizational details and appears designed for selective post-compromise deployment rather than broad commodity distribution.
BellaCiao is implemented primarily in .NET, with later evolution into a C++ variant known as BellaCPP. Across reported variants, the malware establishes persistence by creating Windows services masquerading as legitimate Exchange-related components, attempts to weaken host defenses by disabling Microsoft Defender monitoring, and uses an unusual DNS-driven command mechanism to determine follow-on actions. In documented intrusions, DNS responses encode instructions that govern whether BellaCiao should deploy or remove server-side payloads and where those payloads should be written.
A core BellaCiao use case is delivery of secondary implants to compromised Exchange or IIS servers. Observed payloads include ASPX webshells that support command execution and file transfer, credential-harvesting IIS modules, and tunneling components used to expose internal services or create covert operator access paths. Some variants have been linked to deployment of reverse proxy or SSH-tunneling functionality, including use of Plink and PowerShell-based web server components. BellaCPP preserves the family’s DNS-validation logic and is assessed to support covert tunneling through a secondary DLL, indicating continued emphasis on stealthy remote access and pivoting.
Operational reporting indicates BellaCiao has been used against organizations in the United States, Europe, the Middle East, India, and parts of Asia, with targeting aligned to APT35’s broader espionage mission. Victim sectors and entities have included government and enterprise environments, and the malware has been repeatedly tied to intrusions involving public-facing server exploitation, especially Microsoft Exchange. The exact initial access vector is not always confirmed, but exploitation of Exchange vulnerabilities has been assessed as a likely precursor in multiple cases.
BellaCiao represents APT35’s shift toward more customized tooling, faster post-exploitation enablement, and infrastructure-aware implants that blend persistence, webshell deployment, credential collection, and covert tunneling in a single intrusion workflow.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In the next section, we are going to analyze a new implant called BellaCiao, discovered by security researchers from Bitdefender Labs. ... The BellaCiao is a dropper malware – it is designed to deliver other malware payloads onto a victim’s computer system, based on instructions from C2 server.
The exact initial infection vector is unknown, but we expect Microsoft Exchange exploit chain (like ProxyShell/ProxyNotShell/OWASSRF) or similar software vulnerability. Primary target was Microsoft Exchange servers.
The exact initial infection vector is unknown, but we expect Microsoft Exchange exploit chain (like ProxyShell/ProxyNotShell/OWASSRF) or similar software vulnerability. Primary target was Microsoft Exchange servers.
In the next section, we are going to analyze a new implant called BellaCiao, discovered by security researchers from Bitdefender Labs. ... The BellaCiao is a dropper malware – it is designed to deliver other malware payloads onto a victim’s computer system, based on instructions from C2 server.
The exact initial infection vector is unknown, but we expect Microsoft Exchange exploit chain (like ProxyShell/ProxyNotShell/OWASSRF) or similar software vulnerability. Primary target was Microsoft Exchange servers.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In the next section, we are going to analyze a new implant called BellaCiao, discovered by security researchers from Bitdefender Labs. ... The BellaCiao is a dropper malware – it is designed to deliver other malware payloads onto a victim’s computer system, based on instructions from C2 server.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The exact initial infection vector is unknown, but we expect Microsoft Exchange exploit chain (like ProxyShell/ProxyNotShell/OWASSRF) or similar software vulnerability. Primary target was Microsoft Exchange servers. | Using automated scanners, vulnerable systems are discovered and automatically compromised (spray-and-pray tactic). Malicious payload (typically a webshell to enable remote administration access) is deployed on compromised server.
The first one was a build of IIS-Raid... looking for pre-defined headers with password and command to execute... The dropped .aspx webshell supports 3 operations: Upload Download Command execution
Upon deployment, BellaCiao immediately attempts to disable Microsoft Defender using the following PowerShell command: powershell.exe -exec bypass -c Set-MpPreference -DisableRealtimeMonitoring $true
These executables run as a service (e.g. “Microsoft Exchange Services Health”).
Decrypt three strings using XOR encryption with the key 0x7B : C:\Windows\System32\D3D12_1core.dll SecurityUpdate CheckDNSRecords Load the DLL file at the path decrypted during the previous step and resolve the functions of the two other decrypted strings above with GetProcAddress.
High-level obfuscation and custom code: Designed to bypass security tools that rely on identifying known malware signatures or behaviors.
Legitimate process names specific to Microsoft Exchange server were used to blend in, a common technique known as masquerading.
Decrypt three strings using XOR encryption with the key 0x7B : C:\Windows\System32\D3D12_1core.dll SecurityUpdate CheckDNSRecords Load the DLL file at the path decrypted during the previous step and resolve the functions of the two other decrypted strings above with GetProcAddress.
To receive instructions from C2 server, BellaCiao is using unique approach of domain name resolution and parsing of the returned IP address. A DNS request is performed every 24 hours to resolve a subdomain...
The PowerShell scripts executes the Plink tool for establishing a reverse proxy connection to the C2 to enable interaction with the PowerShell web server
The second variant drops the Plink tool and PowerShell script hardcoded locations.
The second variant drops the Plink tool and PowerShell script hardcoded locations.
Additionally, it is looking for HTTP requests that include keywords “pass”, “pwd”, “password”, or “login”. Any HTTP request that contains one of these words is appended to the file %LocalAppData%\193d910f01-0293e1a6-591d103f.dat, ready for credential exfiltration.
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
APT35 .NET implant characterized as a webshell-tunneling hybrid.
Malware family referenced in connection with Charming Kitten; a C++ variant (BellaCPP) was observed.
A backdoor used in attacks targeting companies in multiple regions, attributed to Iranian threat actors.
Named malware attributed in the text to Iranian development infrastructure (Shuhada base, Tehran); technical functionality is not described in this excerpt.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.