← All Threat Actors
Threat Actor Profile

APT42

CALANQUE G1044 UNC788
▲ High Threat
Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.
Origin Iran
Sponsor Iran (Islamic Republic of)
Motivation Espionage

Target Sectors

Education Government Military Defense Energy Finance Healthcare Pharmaceuticals Civil Society Legal Manufacturing Media NGOs

Known TTPs

PowerShell
Security Software Discovery
Match Legitimate Resource Name or Location
Indicator Removal
Input Capture
Domains
Standard Encoding
Data from Cloud Storage
Visual Basic
Screen Capture
Impersonation
System Network Configuration Discovery
Local Account
Email Accounts
Scheduled Task
Query Public AI Services
Clear Mailbox Data
Keylogging
Web Service
System Information Discovery
Web Protocols
Virtual Private Server
Asymmetric Cryptography
Windows Management Instrumentation
Steal Web Session Cookie
Upload Malware
Tool
Multi-Factor Authentication Interception
Boot or Logon Autostart Execution
Modify Registry
Spearphishing Link
Credentials from Web Browsers

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD