MITRE ATT&CKgroup

G1044 APT42

Published 2025-01-08 Modified 2026-09-22 Official page ↗
Domain
enterprise
Version
1.1
Created
2025-01-08

Description

APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, APT42 exfiltrates data using native features and open-source tools. APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.

Related

Uses · MITRE ATT&CK (35)

  • T1697 Steal Application Specific Passwords technique
  • T1684.001 Impersonation sub-technique
  • T1682 Query Public AI Services technique
  • S1192 NICECURL software (malware)
  • S1193 TAMECAT software (malware)
  • T1070.008 Clear Mailbox Data sub-technique
  • T1608.001 Upload Malware sub-technique
  • T1583.003 Virtual Private Server sub-technique
  • T1585.002 Email Accounts sub-technique
  • T1588.002 Tool sub-technique
  • T1583.001 Domains sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1087.001 Local Account sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1056.001 Keylogging sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1547 Boot or Logon Autostart Execution technique
  • T1053.005 Scheduled Task sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1530 Data from Cloud Storage technique
  • T1016 System Network Configuration Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1056 Input Capture technique
  • T1070 Indicator Removal technique
Show all 35 ›

References