Hacker groupG1044
APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, APT42 exfiltrates data using native features and open-source tools. APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
- Known attack methods
- 32
- Origin
- Iran
- Motive
- Espionage, Data theft
- First seen
- 2015
- Source
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, mapped onto the ATT&CK matrix. Each one is a behaviour you can look for in your own logs, and a control you can test.
Used by this groupNot documented for this groupIn brackets: sub-techniques this group uses, of those that exist.
Reconnaissance
12 techniques · 1 used
Resource Development
9 techniques · 4 used
Initial Access
11 techniques · 1 used
Execution
20 techniques · 3 used
Persistence
22 techniques · 1 used
Privilege Escalation
13 techniques
Stealth
30 techniques · 3 used
Defense Impairment
18 techniques · 1 used
Credential Access
17 techniques · 3 used
Discovery
34 techniques · 4 used
Lateral Movement
9 techniques
Collection
17 techniques · 3 used
Command and Control
18 techniques · 4 used
Exfiltration
9 techniques
Impact
15 techniques
Reconnaissance1
Resource development5
Initial access1
Execution4
Persistence1
Stealth4
Defense impairment1
Credential access3
Discovery4
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
NICECURLTAMECAT