Quick links
Press Enter to search, Esc to close
Threat group profile
MITRE ATT&CK describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, active since at least 2015.
In short
MITRE ATT&CK describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, active since at least 2015. Israel's National Digital Agency says it works in line with the IRGC Intelligence Organization, and the UK NCSC warned in 2023 about its patient spear-phishing of academics, officials, journalists and NGOs.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT42 | Main name on the MITRE ATT&CK group page G1044; also used by the UK NCSC, the Israel National Digital Agency and CERT-EU[1, 2, 5, 8] |
| TA453 | UK NCSC advisory of 26 January 2023, which lists it with APT42, Charming Kitten, Yellow Garuda and ITG18[2, 3] |
| Mint Sandstorm | Israel National Digital Agency; US Treasury (as a name reported by private firms)[4, 5] |
| Educated Manticore | Israel National Digital Agency[5] |
| CharmingCypress | Israel National Digital Agency[5] |
| Yellow Garuda | UK NCSC advisory of 26 January 2023[2] |
| ITG18 | UK NCSC advisory of 26 January 2023[2] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK 31 July 2026 (page last modified)
Describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, focused on the Middle East, active since at least 2015.[1]
MITRE ATT&CK 31 July 2026 (page last modified)
Says APT42 activity has been linked to Magic Hound by other vendors, but the two appear to be distinct entities tracked separately by their originating vendor.[1]
UK National Cyber Security Centre 26 January 2023
Advisory on spear-phishing by Russia-based SEABORGIUM and Iran-based TA453 (APT42, Charming Kitten, Yellow Garuda, ITG18), which it says continued through 2022 against UK and other targets.[2]
UK National Cyber Security Centre 26 January 2023
Says the SEABORGIUM and TA453 campaigns are separate and the two groups are not collaborating.[2, 3]
US Department of the Treasury 27 September 2024
Says IRGC members including Masoud Jalili compromised accounts of officials and advisors to a 2024 presidential campaign and leaked the data. Notes that the intrusions "have been reported as the work of APT 42 and Mint Sandstorm by private security firms".[4]
US Department of the Treasury 27 September 2024
Designated Jalili under Executive Order 13848 as acting for the IRGC; the Department of Justice unsealed an indictment of Jalili and two IRGC co-conspirators and Rewards for Justice offered up to 10 million US dollars.[4]
Israel National Digital Agency November 2025
Says its SpearSpecter campaign was run by Iranian actors aligned with the IRGC Intelligence Organization, operating under the names APT42, Mint Sandstorm, Educated Manticore and CharmingCypress.[5]
Israel National Digital Agency November 2025
Says its analysis gives strong corroborative evidence linking the SpearSpecter footprint to APT42.[5]
CERT-EU 2 May 2025
Cyber Brief 25-05 records that a member of the European Parliament revealed an attempt to target her office, attributed to the Iranian group APT42 and blocked before data was stolen.[8]
Sources differ on names. MITRE ATT&CK keeps APT42 and Magic Hound (Charming Kitten) as distinct entities that overlap, while the UK NCSC advisory of January 2023 lists APT42, Charming Kitten, Yellow Garuda and ITG18 as names of TA453. Sources also differ on the sponsor. MITRE says only "Iranian-sponsored". The Israel National Digital Agency says the actors are aligned with the IRGC Intelligence Organization. The US Treasury names IRGC members for the 2024 election hacking and says the "APT 42" label comes from private firms, so it does not itself equate the two.
Each entry is attributed to the group by the sources cited.
MITRE says APT42 has targeted a variety of industries and countries since at least 2015.[1]
The NCSC says SEABORGIUM and TA453 (APT42) ran spear-phishing campaigns throughout 2022 against academia, defense, government, NGOs, think tanks, politicians, journalists and activists.[2]
CERT-EU records a researchers' report of a campaign that used social engineering to install malicious VPN applications.[6]
CERT-EU records a researchers' report of enhanced social engineering used to reach victims' cloud environments.[7]
The Treasury says IRGC members compromised accounts of officials and advisors to a 2024 presidential campaign.[4]
The Treasury designated Masoud Jalili; the Department of Justice unsealed an indictment.[4]
CERT-EU records that the attempt, attributed to APT42, was blocked before data was stolen.[8]
The Israel National Digital Agency published its report on a campaign it attributes to APT42, with a TAMECAT backdoor and Telegram and Discord command channels.[5]
The MITRE ATT&CK page for APT42 was last modified on this date (version 1.0, created 8 January 2025).[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 26 January 2023 | UK National Cyber Security Centre | AdvisoryAdvisory on spear-phishing by SEABORGIUM and TA453 (APT42) with mitigation advice for organizations and individuals.[2, 3] |
| 1 March 2024 | CERT-EU | Threat intelligence briefCyber Security Brief 24-03 includes a summary of a reported February 2024 campaign by APT42 against journalism, think tanks and NGOs.[6] |
| 3 June 2024 | CERT-EU | Threat intelligence briefCyber Brief 24-06 includes a summary of a reported May 2024 campaign by APT42 against Western NGOs, media and academia.[7] |
| 27 September 2024 | US Department of the Treasury | SanctionsOFAC designated Masoud Jalili for acting for the IRGC in 2024 election hacking. The Department of Justice unsealed an indictment of Jalili and two co-conspirators and Rewards for Justice offered up to 10 million US dollars. The release says "APT 42" is a label from private firms.[4] |
| 2 May 2025 | CERT-EU | Threat intelligence briefCyber Brief 25-05 includes the April 2025 attempt against a Member of the European Parliament attributed to APT42.[8] |
| November 2025 | Israel National Digital Agency | Threat research reportSpearSpecter report on an APT42 campaign, with recommendations on monitoring, awareness, protocol handlers, network filtering and endpoint hardening.[5] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Establish Accounts: Email Accounts T1585.002
The NCSC says SEABORGIUM and TA453 actors register consumer email accounts that match the names of the people it impersonates.[1, 2]
Acquire Infrastructure: Domains T1583.001
MITRE and the NCSC say it registers domains, some posing as news outlets and login services, to host fake login pages.[1, 2]
Phishing: Spearphishing Link T1566.002
The NCSC says it sends links to credential stealing sites or to malware on a file sharing site, including links disguised as Zoom meetings.[1, 2]
Valid Accounts T1078
The NCSC says SEABORGIUM and TA453 actors log in to victims' accounts with credentials captured on fake login pages.[2]
NICECURL VBScript backdoor
MITRE says it downloads additional modules and talks to its server over HTTPS.[9]
TAMECAT PowerShell backdoor framework
MITRE says it runs PowerShell or C# content; the Israeli agency describes modules that collect browser data and credentials, run remote commands and exfiltrate data.[10, 5]
PINEFLOWER Android malware
MITRE says APT42 may begin operations with spearphishing emails or this Android malware.[1]
POWERPOST PowerShell script
MITRE says it collects local account names, system and network information and screenshots.[1]
GHAMBAR Information collector
MITRE says it collects system and network information and takes screenshots.[1]
VINETHORN Payload disguised as a VPN app
MITRE says the payload was masqueraded as a VPN application.[1]
MITRE advises hardware-based tokens that bind to the login domain and conditional access that allows logins only from trusted devices.
Counters T1539
The NCSC advises disabling mail forwarding and turning on the provider's automated email scanning.
Counters T1114.002
MITRE advises SPF, DKIM and DMARC so recipients can filter messages from lookalike sender domains.
Counters T1566.002
The Israeli agency advises disabling the Windows search-ms protocol handler, which the campaign used to deliver files without sending them directly.
Counters T1566.002
The Israeli agency advises Constrained Language Mode, AMSI integration, script block logging and application control such as AppLocker.
Counters T1059.001
Customers can follow reported activity from Iran-linked groups and check it against their own sector and people at risk.
Customers can watch for lookalike domains and fake login pages that imitate their organization.
Customers can look for exposure of senior staff and their families that could be used to build a convincing approach.
Customers can look for stolen staff credentials and leaked data that could support impersonation.
MITRE ATT&CK describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, active since at least 2015. The Israel National Digital Agency says the actors are aligned with the IRGC Intelligence Organization.
Sources differ. The UK NCSC lists APT42 and Charming Kitten as names of TA453. MITRE ATT&CK keeps APT42 and Magic Hound as distinct, overlapping entities.
The NCSC lists academia, defense, government, NGOs, think tanks, politicians, journalists and activists. The Israeli agency reports senior defense and government officials and their family members, and the US Treasury links IRGC members to the 2024 US presidential campaign intrusions that private firms call APT 42.
Mostly by social engineering. It builds trust with fake or hijacked identities, sends links to fake login pages, and in the Israeli agency's report adds WhatsApp contact and a PowerShell backdoor called TAMECAT.
MITRE lists NICECURL and TAMECAT, and names PINEFLOWER, POWERPOST, GHAMBAR and VINETHORN in its technique notes.
Turn on multi-factor authentication, prefer hardware keys, disable mail forwarding, train senior staff to verify unusual approaches, and harden PowerShell.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.