Optimizer
Optimizer is a bespoke backdoor associated with the Iran-aligned threat cluster BladedFeline, which ESET assesses with medium confidence to be a sub-cluster of OilRig, a group linked in the reporting to Iran’s Ministry of Intelligence and Security (MOIS). BladedFeline has been active since at least September 2017 and has used Optimizer alongside other custom malware including Shahmaran, Whisper (aka Veaty), and Spearal in cyber-espionage operations. Reported targeting includes Kurdish and Iraqi government officials, the Kurdistan Regional Government (KRG), other entities in Iraq, governmental organizations in Azerbaijan, and a regional telecommunications provider in Uzbekistan. The reporting states that BladedFeline’s malware toolkit, including Optimizer, provides remote code execution and data exfiltration capabilities. Optimizer is described only as one of the bespoke backdoors delivered in these intrusions; no further technical details, infection vector, or specific indicators of compromise for Optimizer are provided in the content. In the broader campaigns where it was used, researchers noted that initial access into some Iraqi and KRG environments was unclear, though exploitation of an internet-facing application was suspected in some cases, and the actor also used persistence and access-enablement tooling such as the Flog web shell, PrimeCache malicious IIS module, Slippery Snakelet implant, and Laret and Pinar tunneling tools.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BladedFeline is known to employ a diverse malware toolkit, including backdoors like Shahmaran, Whisper, Spearal, and Optimizer, each offering remote code execution (RCE) and data exfiltration capabilities.
BladedFeline is known to employ a diverse malware toolkit, including backdoors like Shahmaran, Whisper, Spearal, and Optimizer, each offering remote code execution (RCE) and data exfiltration capabilities.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used in targeted intrusions against Kurdish and Iraqi government officials.
Backdoor used by BladedFeline providing remote code execution and data exfiltration.
Bespoke backdoor used in BladedFeline operations; specific functionality not described in the provided content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.