APT PROFILE – APT42

APT42 is an Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government. We estimate with moderate confidence that APT42 operates on behalf of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization (IRGC-IO) based on targeting patterns that align with the organization’s operational mandates and priorities.

Active since at least 2015, APT42 is characterized by highly targeted spear phishing and surveillance operations against individuals and organizations of strategic interest to Iran. The group’s operations, which are designed to build trust and rapport with their victims, have included accessing the personal and corporate email accounts of government officials, former Iranian policymakers or political figures, members of the Iranian diaspora and opposition groups, journalists, and academics who are involved in research on Iran. After gaining access, the group deployed mobile malware capable of tracking victim locations, recording phone conversations, accessing videos and images, and extracting entire SMS inboxes. APT42 has demonstrated the ability to alter its operational focus as Iran’s priorities evolve over time. We anticipate APT42 will continue to conduct cyber espionage operations in support of Iran’s strategic priorities in the long term based on its extensive operational history and imperviousness to public reporting and infrastructure takedowns.

Alias: APT42 Alias Mint Sandstorm, TA453, Yellow Garuda
Motivation: Espionage

Targeted Countries

USA, Canada, United Kingdom, Germany, France, Middle East, Australia

APT42 Campaigns Tracked by CYFIRMA

Malware used by APT 42
NICECURL,TAMECAT,NokNok

Tools used by APT42:
CHAIRSMACK, GHAMBAR, POWERPOST, BROKEYOLK, MAGICDROP, PINEFLOWER, TABBYCAT, TAMECAT, VBREVSHELL, VINETHORN, DOSTEALER

MITRE ATT&CK Techniques used by APT 42

APT 42’s Recent Campaign Highlights and Trends

• In a recent campaign, threat actors from APT42 targeted organizations in Western and Middle Eastern countries through social engineering attacks. They impersonated journalists to gain the trust of their targets and infiltrated corporate networks and cloud environments. The attackers used malicious emails to deliver two custom backdoors, named Nicecurl and Tamecat, which allowed them to execute commands and steal sensitive data from the compromised systems.
• In recent campaigns, APT42 has predominantly focused on targeting entities that oppose Iran, including government and political bodies, media and journalism outlets, healthcare organizations, academic institutions, and non-governmental organizations (NGOs).
• APT42’s activities are not limited to direct cyber-attacks. The group also conducts extensive credential harvesting operations, intricately designed to appear as legitimate interactions. These operations are carried out through carefully crafted spear-phishing campaigns that often impersonate well-known news outlets or NGOs. For example, domains masquerading as major publications like The Washington Post and The Economist have been used to disseminate malicious links that redirect users to fake login pages, effectively stealing their credentials.
• Given APT42’s historical resilience and adaptability, it is expected that they will continue their cyber espionage operations in support of Iran’s strategic objectives, particularly as geopolitical dynamics evolve.