Iranian APT42 Actors Conducting World Wide Surveillance Operations

APT42 (aka Damselfly, UNC788, CALANQUE, Charming Kitten) is a sophisticated Iranian state-sponsored cyber espionage group. 

This Advanced Persistent Threat (APT) group is known for its ability to carry out long-term and focused digital surveillance campaigns.

The major targets of such actions are often government bodies, defense contractors, and critical infrastructure.

Cybersecurity researchers at Cyfirma recently detected that Iranian APT42 actors have been actively conducting world wide surveillance operations.

Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot

Technical Analysis

APT42 utilizes many diverse advanced methods of operation aimed at maintaining an invisible presence in the penetrated network.

They are mainly interested in data exfiltration, intelligence gathering, and strategic reconnaissance.

The activities of this group usually coincide with Iran’s geopolitical interests consequently displaying the changing environment of nation-state hacking.

With moderate confidence, security analysts believe that the APT42 operates under the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). 

This evaluation is based on the common targeting patterns of APT42 that are consistent with the IRGC-IO’s strategic objectives and operational mandates. 

In fact, the group’s cyber espionage activities continually advance Iran’s geopolitical interests consequently reinforcing this link, reads the report.

APT42 specializes in highly targeted spear phishing and surveillance operations since 2015.

The group focuses on individuals and organizations of strategic importance to Iran, including government officials, former Iranian policymakers, diaspora members, opposition groups, journalists, and academics studying Iran.

APT42’s tactics often involve building trust with victims to compromise personal and corporate email accounts, enabling long-term intelligence gathering that aligns with Iranian state interests.

Countries targeted by this threat actor are the USA, Canada, the United Kingdom, Germany, France, the Middle East, and Australia. Here below we have mentioned all the tools that are used by APT42:-

• CHAIRSMACK
• GHAMBAR
• POWERPOST
• BROKEYOLK
• MAGICDROP
• PINEFLOWER
• TABBYCAT
• TAMECAT
• VBREVSHELL
• VINETHORN
• DOSTEALER

APT42 deploys highly sophisticated mobile malware that enables complete surveillance soon after accessing the targeted network. These include location tracking, call recording, media access, and SMS content extraction.

Notably, the group demonstrates an ability to adapt, changing its tactics in line with Iran’s new strategic priorities.

Despite public outings and infrastructure takedowns, APT42’s resilient nature and extensive track record of operations indicate that it will continue to engage in cyber espionage attempts to advance Iranian goals for many years ahead.

Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Acces