APT42 is characterized by highly targeted spear phishing and surveillance operations against individuals and organizations of strategic interest to Iran.
The group’s operations, which are designed to build trust and rapport with their victims, have included accessing the personal and corporate email accounts of government officials, former Iranian policymakers or political figures, members of the Iranian diaspora and opposition groups, journalists, and academics who are involved in research on Iran.
After gaining access, the group has deployed mobile malware capable of tracking victim locations, recording phone conversations, accessing videos and images, and extracting entire SMS inboxes.
APT42 has a demonstrated ability to alter its operational focus as Iran’s priorities evolve over time.
Mandiant anticipates APT42 will continue to conduct cyber espionage operations in support of Iran’s strategic priorities in the long term based on their extensive operational history and imperviousness to public reporting and infrastructure takedowns.
Sign Up For Threat Alerts
Feb 06, 2023
Vector Stealer Targets RDP Files For Exfiltration
Vector Stealer is an information stealer sold on underground forums since 2022. The malicious software...
Feb 05, 2023
Operation Ice Breaker
This is a new threat actor,Analysts are tracking it as Ice Breaker APT. Although research...
Feb 05, 2023
Operation Ice Breaker
ttt
Feb 05, 2023
Trigona Ransomware Analysis
Trigona ransomware appeared on the threat landscape in late 2022 and threatens to release stolen...
Feb 02, 2023
Ukraine CERT-UA: Compromised Email Address Used To...
An adversary was discovered using a compromised e-mail address to send phishing emails with a...
Feb 01, 2023
Ukraine Government Sector Targeted With The DolphinCape...
The government sector of Ukraine was targeted with spear-phishing emails with a malicious attachment which...
Feb 01, 2023
Ukraine Government Sector Targeted With The DolphinCape...
The government sector of Ukraine was targeted with spear-phishing emails with a malicious attachment which...
Jan 31, 2023
Multiple Malware Variants Distributed Through Microsoft OneNote
Spear-phishing emails with malicious Microsoft OneNote attachments were discovered delivering variants from the AsyncRAT, Formbook¸...
Jan 30, 2023
Playing Whack-a-Mole With New Dharma Ransomware Variants
The Dharma ransomware family was initially identified in 2016 and operates as a Ransomware-as-a-Service (RaaS)...
Jan 29, 2023
APT15 Targets Multiple Sectors With Turian Backdoor
APT15, also known as Playful Taurus, is an advanced persistent threat (APT) that conducts a...
Jan 26, 2023
Vice Society Ransomware Group Targets Manufacturing Companies
The Vice Society threat group was discovered targeting multiple sectors including manufacturing companies in Brazil....
Jan 26, 2023
US Cert Alert – Alert (AA23-025A) Protecting...
Although this campaign appears financially motivated, the authoring organizations assess it could lead to additional...
Jan 25, 2023
Emotet Malware Makes a Comeback with New...
The Emotet malware operation has continued to refine its tactics in an effort to fly...
Jan 25, 2023
DragonSpark
The DragonSpark attacks represent the first concrete malicious activity where Analysts observe the consistent use...
Jan 25, 2023
PLAY Ransomware
PLAY is simple but heavily obfuscated with a lot of unique tricks that have not...