Pulse Detail — Threat Intelligence

PULSE NAME

Whispering in the dark

WHITE BladedFeline AlienVault 2025-06-10 Modified: 2025-07-10

IOCs

MEDIUM VOLUME

ESET researchers uncovered a cyberespionage campaign by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has targeted Kurdish and Iraqi government officials since at least 2017, using various malicious tools including the Whisper backdoor, PrimeCache IIS module, and reverse tunnels. BladedFeline maintains persistent access to high-ranking officials in both the Kurdistan Regional Government and Iraqi government, likely for espionage purposes. The group's toolset includes sophisticated backdoors, webshells, and custom tunneling applications. ESET assesses with medium confidence that BladedFeline is a subgroup of OilRig, based on shared code, targets, and tactics. The campaign also extended to a telecommunications provider in Uzbekistan.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1583 T1132.001 T1059.007 T1573.001 T1140 T1586.002 T1190 T1583.001 T1070.006 T1595.002 T1003.001 T1048.001 T1583.003 T1041 T1059.001 T1547.001 T1559 T1078 T1546 T1573.002 T1059.006 T1059.003 T1070.004 T1071.001 T1105 T1569.002

MALWARE FAMILIES

WhisperGate - S0689 PrimeCache Shahmaran Slippery Snakelet Laret Pinar Flog RDAT - S0495

Indicators of Compromise (2 / 33 total)

All FileHash-MD5 URL FileHash-SHA1 FileHash-SHA256

TYPE	INDICATOR	DESCRIPTION	CREATED
URL	http://178.209.51.61:8000/wincapsrv.exe	—	2025-06-10
URL	https://zaincell.store/request/	—	2025-06-10

References (1)

↗ https://www.welivesecurity.com/en/eset-research/bladedfeline-whispering-dark/