Thursday, May 8, 2025
HomeCyber AttackIranian APT42 Actors Conducting World Wide Surveillance Operations

Iranian APT42 Actors Conducting World Wide Surveillance Operations

Published on

SIEM as a Service

Follow Us on Google News

APT42 (aka Damselfly, UNC788, CALANQUE, Charming Kitten) is a sophisticated Iranian state-sponsored cyber espionage group. 

This Advanced Persistent Threat (APT) group is known for its ability to carry out long-term and focused digital surveillance campaigns.

The major targets of such actions are often government bodies, defense contractors, and critical infrastructure.

- Advertisement - Google News

Cybersecurity researchers at Cyfirma recently detected that Iranian APT42 actors have been actively conducting world wide surveillance operations.

Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot

Technical Analysis

APT42 utilizes many diverse advanced methods of operation aimed at maintaining an invisible presence in the penetrated network.

They are mainly interested in data exfiltration, intelligence gathering, and strategic reconnaissance.

The activities of this group usually coincide with Iran’s geopolitical interests consequently displaying the changing environment of nation-state hacking.

With moderate confidence, security analysts believe that the APT42 operates under the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). 

This evaluation is based on the common targeting patterns of APT42 that are consistent with the IRGC-IO’s strategic objectives and operational mandates. 

In fact, the group’s cyber espionage activities continually advance Iran’s geopolitical interests consequently reinforcing this link, reads the report.

APT42 specializes in highly targeted spear phishing and surveillance operations since 2015.

The group focuses on individuals and organizations of strategic importance to Iran, including government officials, former Iranian policymakers, diaspora members, opposition groups, journalists, and academics studying Iran.

Targeted industries (Source – Cyfirma)

APT42’s tactics often involve building trust with victims to compromise personal and corporate email accounts, enabling long-term intelligence gathering that aligns with Iranian state interests.

Countries targeted by this threat actor are the USA, Canada, the United Kingdom, Germany, France, the Middle East, and Australia. Here below we have mentioned all the tools that are used by APT42:-

  • CHAIRSMACK
  • GHAMBAR
  • POWERPOST
  • BROKEYOLK
  • MAGICDROP
  • PINEFLOWER
  • TABBYCAT
  • TAMECAT
  • VBREVSHELL
  • VINETHORN
  • DOSTEALER

APT42 deploys highly sophisticated mobile malware that enables complete surveillance soon after accessing the targeted network. These include location tracking, call recording, media access, and SMS content extraction.

Notably, the group demonstrates an ability to adapt, changing its tactics in line with Iran’s new strategic priorities.

Despite public outings and infrastructure takedowns, APT42’s resilient nature and extensive track record of operations indicate that it will continue to engage in cyber espionage attempts to advance Iranian goals for many years ahead.

Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Acces

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Cisco IOS XE Wireless Controllers Vulnerability Lets Attackers Seize Full Control

A critical security flaw has been discovered in Cisco IOS XE Wireless LAN Controllers...

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Healthcare Sector Becomes a Major Target for Cyber Attacks in 2025

The healthcare sector has emerged as a prime target for cyber attackers, driven by...

Popular Instagram Blogger’s Account Hacked to Phish Users and Steal Banking Credentials

A high-profile Russian Instagram blogger recently fell victim to a sophisticated cyberattack, where scammers...

Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months

The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in...