working of apt 42 group apt campaign episode 1

APT42 is an Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.

Reconnaissance	Execution	Defense Evasion	Lateral Movement
T1595.002	T1047	T1218.011	T1021.001
T1589.001	T1053.005	T1027
T1598.003	T1059.003	T1562.001	Collection
T1589.002	T1059.001	T1036.005	T1114
T1589	T1204.001	T1112	T1005
Resource Development	T1204.002	T1562	T1113
T1585.002	T1059.005	T1564.003	T1114.002
T1583.006		T1070.004	T1114.001
T1588.002	Persistence	T1562.004	T1560.001
T1584.001	T1505.003	T1070.003	T1056.001
T1583.001	T1053.005
T1586.002	T1136.001	Credentials

APT 42’s Recent Campaign Highlights and Trends

• In a recent campaign, threat actors from APT42 targeted organizations in Western and Middle Eastern countries through social engineering attacks. They impersonated journalists to gain the trust of their targets and infiltrated corporate networks and cloud environments. The attackers used malicious emails to deliver two custom backdoors, named Nicecurl and Tamecat, which allowed them to execute commands and steal sensitive data from the compromised systems.
• In recent campaigns, APT42 has predominantly focused on targeting entities that oppose Iran, including government and political bodies, media and journalism outlets, healthcare organizations, academic institutions, and non-governmental organizations (NGOs).
• APT42’s activities are not limited to direct cyber-attacks. The group also conducts extensive credential harvesting operations, intricately designed to appear as legitimate interactions. These operations are carried out through carefully crafted spear-phishing campaigns that often impersonate well-known news outlets or NGOs. For example, domains masquerading as major publications like The Washington Post and The Economist have been used to disseminate malicious links that redirect users to fake login pages, effectively stealing their credentials.
• Given APT42’s historical resilience and adaptability, it is expected that they will continue their cyber espionage operations in support of Iran’s strategic objectives, particularly as geopolitical dynamics evolve.