Mandiant considers both APT35 and APT42 to be IRGC-affiliated. Still, many resources show they are separate groups and correlate with each other. Some sources consider APT42 as one of the names of another Iran state-sponsored cyber espionage group APT35. Mandiant observed in March 2022 that the APT42 had used POWERPOST, a custom reconnaissance tool built to collect data such as system information and local account names on a local host. PINEFLOWER’s MD5 Hash search output on SOCRadar’s Threat Hunting pageĪlthough APT42’s main objective is credential harvesting, the group also uses lightweight tools and custom backdoors when its objective becomes wide-ranging.

Civil society and non-profit organizations,įrom 2015 until the present, APT42’s attacks have been observed in more than 15 countries, including the United States, Australia, Germany, the United Kingdom, and so on.

They mainly target individuals and organizations particularly interested in the Iranian government or who have opposing ideas from Iran’s regime.Īlso, the group is targeting a few specific sectors, as follows: The group focuses on the Middle East region. Targets of APT42ĪPT42 follows other Iranian state-sponsored cybercriminal groups’ targeting patterns. The group seems mainly focused on spearphishing attacks, which is a type of phishing attack targeting individuals or organizations known as high-profile or in a specific role-using impersonation to look like a trusted person during its attacks separates the group from other Iranian APT groups. The group is allegedly affiliated with the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization (IRGC-IO) and operates behalf of them.

APT42 -also known as Crooked Charms and TA453 – is a cyber espionage group linked to Iran.

In September 2022, Mandiant released a report detailing the APT42 with at least 30 confirmed cyber espionage operations dating back to 2015. Recently, in July 2022, the Iranian threat actor APT42 conducted a cyber-attack against the Albanian government.

Daemon darknet