BladedFeline

Summary

Iran-aligned espionage group that ESET has tracked since 2023 and dates back to at least 2017, when it compromised officials of the Kurdistan Regional Government (KRG) with implants traceable to OilRig; ESET assesses with medium confidence that it is a subgroup of OilRig. ESET's on-victim timeline runs from a reverse shell on a KRG system in September 2017 to February 2024. It keeps access to Kurdish diplomatic officials and Iraqi government officials, and targeted a regional telecommunications provider in Uzbekistan from March 2023. In 2023 it used the Shahmaran and Slippery Snakelet backdoors; from January 2024 ESET found the Whisper backdoor, which runs its C&C through a compromised Exchange webmail account (T1586.002), the PrimeCache malicious IIS module, the Laret and Pinar reverse tunnels and the Spearal backdoor, installed by Python droppers and Windows services (T1059.006, T1569.002) and persisted through the startup folder (T1547.001). It timestomps its own malware (T1070.006), dumps LSASS (T1003.001) and encrypts PrimeCache traffic with RSA and AES (T1573.002).

Attribution

ESET only; likely an OilRig subgroup (medium confidence)

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• ESET Research (Research, 2025-06-05)
  An Iran-aligned espionage group; likely a subgroup of OilRig (medium confidence)

Campaigns 5

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 7

Malware and tools 7

Infrastructure patterns

• Compromised Exchange webmail accounts as C&C mailboxes for Whisper (ESET, 2025)

Reporting and advisories 2

• ESET Research
  BladedFeline: Whispering in the dark (Jun 2025)
• ESET Research
  ESET APT Activity Report Q2–Q3 2026 (Oct 2026)