APT42
Also known as UNC788, CALANQUE, CALANQUE ION
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.
Targets: Education, Government, Military, Defense, Energy, Finance, Healthcare, Pharmaceuticals, Civil Society, Legal, Manufacturing, Media, NGOs, Australia, Europe
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1016 System Network Configuration DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1056 Input CaptureT1056.001 KeyloggingT1059.001 PowerShellT1059.005 Visual BasicT1070 Indicator RemovalT1070.008 Clear Mailbox DataT1071.001 Web ProtocolsT1082 System Information DiscoveryT1087.001 Local AccountT1102 Web ServiceT1111 Multi-Factor Authentication InterceptionT1112 Modify RegistryT1113 Screen CaptureT1132.001 Standard EncodingT1518.001 Security Software DiscoveryT1530 Data from Cloud StorageT1539 Steal Web Session CookieT1547 Boot or Logon Autostart ExecutionT1555.003 Credentials from Web BrowsersT1566.002 Spearphishing LinkT1573.002 Asymmetric CryptographyT1583.001 DomainsT1583.003 Virtual Private ServerT1585.002 Email AccountsT1588.002 ToolT1608.001 Upload MalwareT1682 Query Public AI ServicesT1684.001 ImpersonationT1697 Steal Application Specific Passwords
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.mandiant.com/resources/blog/apt42-charms-cons-compromises
- https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf
- https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
- https://attack.mitre.org/groups/G1044
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations
- https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.