Wednesday, April 24, 2024

Iranian APT42 Deploys Custom Android Spyware to Spy on Targets of Interest

The cybersecurity experts at Mandiant security have recently uncovered custom Android malware that was developed specifically to spy on Android devices. While this custom malware was actively used by APT42, an Iranian state-sponsored hacking group.

Here the Iranian government interests are specifically targeted by APT42’s cyberespionage activities. It was seven years ago that APT42 began to show signs of activity. This activity was centered on lengthy spear-phishing campaigns. 

The following entities were targeted by those lengthy spear-phishing campaigns:-

  • Government officials
  • Policymakers
  • Journalists
  • Academics
  • Iranian dissidents

Hackers are on the lookout for account credentials in order to steal them. Moreover, many of the instances involve the deployment of a custom Android malware strain as well.

APT42 Operations

Operational activities under APT42 can broadly be categorized into three segments, and here they are mentioned below:-

  • Credential harvesting
  • Surveillance operations
  • Malware deployment


Since 2015, in 14 different countries, there have been at least 30 missions carried out by the operators of APT42. As a result of security mistakes, they have been tracked by security experts. But, the fact is that it’s only a small portion of what was revealed.

As a result of the group’s (APT42) consistent approach, the following entities have been targeted:-

  • Western think tanks
  • Researchers
  • Journalists
  • Current Western government officials
  • Former Iranian government officials
  • Iranian diaspora abroad

Here below we have mentioned all the industries targeted:-

  • Civil society and non-profits
  • Education
  • Government
  • Healthcare
  • Legal and professional services
  • Manufacturing
  • Media and entertainment
  • Pharmaceuticals

In order to match changing intelligence-collection interests, the group changed its targets for several times. The hacker’s primary objective was almost always to harvest credentials by redirecting their victims to phishing pages.

A shortened link is usually sent by them, or a PDF attachment containing a button that leads to a page where you can harvest the victims’ credentials.

Links Between APT42 and Ransomware

There is an association between the TTPs of APT42 and APT42’s use of BitLocker in ransomware activities. While this was reported by Microsoft in November 2021.

A further point made by Mandiant is that the clusters of intrusion activity commonly associated with APT42 and UNC2448 can be found to be related.

UNC2448 is an Iranian-based threat actor that is well known for scanning extensively for vulnerabilities as part of its activities. However, apart from this, the technical overlap between APT42 and UNC2448 has not been observed by Mandiant at this time.

According to Mandiant report, both APT42 and APT35 appear to be handles belonging to the IRGC (Islamic Revolutionary Guard Corps), with a moderate level of confidence. 

It is noteworthy that the United States has designated this organization as a terrorist organization or group.


Latest articles

Phishing Attacks Rise By 58% As The Attackers Leverage AI Tools

AI-powered generative tools have supercharged phishing threats, so even newbie attackers can effortlessly create...

Multiple MySQL2 Flaw Let Attackers Arbitrary Code Remotely

The widely used MySQL2 has been discovered to have three critical vulnerabilities: remote Code...

CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany,...

Spyroid RAT Attacking Android Users to Steal Confidential Data

A new type of Remote Access Trojan (RAT) named Spyroid has been identified.This...

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles