APT42
APT42 is an Iranian state-linked cyber espionage threat actor associated with the Islamic Revolutionary Guard Corps, specifically described in the content as IRGC-IO affiliated, and overlapping with APT35 activity. Known aliases in the provided content include APT42, Educated Manticore, Charming Kitten, and Mint Sandstorm. The group is described as highly focused on espionage and identity-centric intrusions, prioritizing social engineering, credential harvesting, adversary-in-the-middle phishing, MFA interception, and session hijacking. The content states that APT42 commonly begins with legitimate contact over email, WhatsApp, or Telegram, builds trust over time, and then delivers phishing links; it has also impersonated services such as WhatsApp, Microsoft Teams, Google Meet, Dropbox, YouTube, and media or think tank brands using typosquatted domains and hosted phishing pages on platforms including Google Sites, OneDrive, and Cloudflare Workers. Reported targets include journalists, researchers, dissidents, political consultants, Israeli journalists and academics, Israeli military, government, and diplomatic organizations, and both Democratic and Republican U.S. presidential campaign personnel. The content states that in 2024 APT42 compromised Trump campaign materials, stole internal documents, and attempted to leak them to journalists, and that Google and Microsoft reported targeting of both U.S. presidential campaigns. Post-compromise, APT42 is described as using built-in Microsoft 365 features and publicly available tools to avoid detection, including registering its own MFA authenticator, reading Outlook mail, and downloading files from OneDrive and SharePoint. Malware and tooling mentioned in the content include NICECURL, VINETHORN, GHAMBAR, and POWERPOST. NICECURL communicated with command and control over HTTPS; APT42 also encoded C2 traffic with Base64, used anonymized infrastructure and VPSs to interact with victim environments, masqueraded the VINETHORN payload as a VPN application, collected system information with malware such as GHAMBAR and POWERPOST, modified Registry keys for persistence, and used scheduled tasks for persistence. The content also notes that APT42 leaves minimal endpoint artifacts and may be more visible in cloud and proxy logs.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Independent Media
- Academia & Research
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- IR
Tradecraft
57 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
16 malware families attributed to this actor across reporting.
11 additional families tracked in Mallory.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
64 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iranian cyber-espionage group focused on targeting specific individuals such as journalists, researchers, dissidents, and political consultants. The group uses social engineering, credential harvesting, adversary-in-the-middle phishing, MFA interception, session cookie theft, and then operates inside cloud services such as Microsoft 365 for email and document collection without deploying malware on endpoints.
Uses social engineering priming to build trust with victims before delivering malicious files.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.