APT42

Origin🇮🇷 Irã

Techniques (MITRE ATT&CK)32

SourceMITRE ATT&CK

State sponsor: Iran (Islamic Republic of)Attribution confidence: 50%Target categories: Education, Government, Military, Defense, Energy, Finance, Healthcare, Pharmaceuticals, Civil Society, Legal, Manufacturing, Media, NGOs, Pharmaceuticals

Targeted regions: Australia · Europe · Israel · Middle East · United States

Also known as:CALANQUECALANQUE IONUNC788

Vexday analysis

APT42 é um grupo de espionagem cibernética patrocinado pelo Irã, ativo pelo menos desde 2015, com foco principal em alvos no Oriente Médio, mas com histórico de atuação em diversas indústrias e países. O grupo inicia suas operações por meio de e-mails de spearphishing e/ou do malware Android PINEFLOWER, monitorando e coletando informações dos sistemas e dispositivos comprometidos antes de exfiltrar dados com ferramentas nativas e de código aberto. Rastreado pelo MITRE ATT&CK sob o identificador G1044, o grupo possui 32 técnicas documentadas e é associado por outros fornecedores ao cluster conhecido como Magic Hound.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity45

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 32

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Query Public AI Services

Resource development

Domains Virtual Private Server Email Accounts Tool Upload Malware

Initial access

Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell Visual Basic

Persistence

Boot or Logon Autostart Execution

Credential access

Multi-Factor Authentication Interception Steal Web Session Cookie Credentials from Web Browsers

Discovery

System Network Configuration Discovery System Information Discovery Local Account Security Software Discovery

Collection

Input Capture Keylogging Screen Capture Data from Cloud Storage

Command and control

Web Protocols Web Service Standard Encoding Asymmetric Cryptography

defense-impairment

Modify Registry

stealth

Match Legitimate Resource Name or Location Indicator Removal Clear Mailbox Data Impersonation

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

APT42 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →