APT42

▲ High Threat Iran

Primary Aliases: UNC788 CALANQUE G1044 GreenBravo

Sponsor / State Affiliation Iran (Islamic Republic of)

Primary Motivation Espionage

Active Timeline Unknown – Present

Confidence Rating 70% (Grounded)

Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Education Government Military Defense Energy Finance Healthcare Pharmaceuticals Civil Society Legal Manufacturing Media NGOs

🛡️ MITRE ATT&CK® Attack Lifecycle (32 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spearphishing Link

Execution 3

T1059 PowerShell

T1059 Scheduled Task

T1059 Boot or Logon Autostart Execution

Persistence & Privilege Escalation 1

T1547 Modify Registry

Defense Evasion 1

T1027 Indicator Removal

Credential Access & Discovery 5

T1003 Security Software Discovery

T1003 System Network Configuration Discovery

T1003 Keylogging

T1003 System Information Discovery

T1003 Credentials from Web Browsers

Lateral Movement & Collection 1

T1021 Screen Capture

Command & Control 1

T1071 Web Protocols

Operational Techniques 19

T1000 Match Legitimate Resource Name or Location

T1000 Input Capture

T1000 Standard Encoding

T1000 Data from Cloud Storage

T1000 Visual Basic

T1000 Impersonation

T1000 Local Account

T1000 Email Accounts

T1000 Query Public AI Services

T1000 Clear Mailbox Data

T1000 Web Service

T1000 Virtual Private Server

T1000 Asymmetric Cryptography

T1000 Windows Management Instrumentation

T1000 Steal Web Session Cookie

T1000 Upload Malware

T1000 Multi-Factor Authentication Interception

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Iranian APT42 and APT35 Utilizing LLMs for AI-Augmented Spear-Phishing and Tamecat Malware Deployment

Attacks and Vulnerabilities 2026-08-15

Copied to clipboard

LINK COPIED TO CLIPBOARD