Loading threat actor…
APT42, also tracked as SpearSpecter and associated with aliases including Mint Sandstorm, Educated Manticore, and CharmingCypress, is an Iranian state-aligned cyber-espionage threat actor linked to the Islamic Revolutionary Guard Corps Intelligence Organization. The group conducts targeted intelligence collection against individuals and organizations of strategic interest, with a strong emphasis on senior government and defense officials and, in some cases, their family members. APT42 is known for prolonged, highly personalized social-engineering operations rather than broad commodity phishing. Operators build trust over days or weeks, including direct outreach over messaging platforms, and use lures such as conferences, strategic meetings, and document requests to induce credential theft or malware execution. The actor has used spoofed meeting or event pages for real-time credential harvesting and has paired these lures with stealthy malware delivery chains. A notable capability associated with this activity is deployment of the modular PowerShell backdoor TAMECAT for long-term access, reconnaissance, remote command execution, and data theft. TAMECAT operates largely in memory, uses obfuscated loaders and trusted Windows binaries, and has employed delivery techniques involving WebDAV, malicious shortcut files, abuse of the Windows search-ms protocol, and cloud-hosted staging infrastructure. Persistence has been established through per-user autorun mechanisms and other registry-backed logon execution methods. TAMECAT supports broad host reconnaissance, including collection of system, network, software, process, privilege, and security-product information. It also enables theft of browser data, including cookies and other stored information, collection of documents and archives, screenshot capture, staging and theft of Outlook mailbox cache data, and compressed exfiltration of selected files. Reported tradecraft includes use of modular command-and-control over HTTPS and, in observed operations, Telegram and Discord, along with runtime obfuscation, living-off-the-land techniques, and reduced disk artifacts to hinder detection. Overall, APT42 is characterized by patient human-centric targeting, credential theft, stealthy persistence, in-memory post-exploitation, and sustained exfiltration in support of Iranian intelligence objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
1 malware family attributed to this actor across reporting.
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SpearSpecter (APT42) is an Iranian APT group known for cyber-espionage operations, often targeting individuals and organizations of strategic interest to Iran.
Described as an Iran-linked APT conducting a campaign using weeks-long WhatsApp social-engineering lures and deploying a fileless backdoor (TAMECAT) to target the defense sector.
Iran-aligned espionage campaign targeting high-value senior defense and government officials through long-term relationship-building social engineering, credential harvesting, and deployment of the modular TAMECAT backdoor for persistence, reconnaissance, data theft, and covert exfiltration.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.