APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, APT42 exfiltrates data using native features and open-source tools. APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps…
- ATT&CK ID
- G1044
- Origin
- Iran
- Techniques
- 29
- Tools
- 2
Techniques
Reconnaissance
Resource Development
Acquire InfrastructureEstablish AccountsObtain CapabilitiesStage Capabilities
Initial Access
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting Interpreter
Persistence
Scheduled Task/JobModify RegistryBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart Execution
Stealth
MasqueradingIndicator RemovalSocial Engineering
Defense Impairment
Credential Access
Input CaptureMulti-Factor Authentication InterceptionSteal Web Session CookieCredentials from Password StoresSteal Application Specific Passwords
Discovery
System Network Configuration DiscoverySystem Information DiscoveryAccount DiscoverySoftware Discovery
Collection
Input CaptureScreen CaptureData from Cloud Storage
Command and Control
Application Layer ProtocolWeb ServiceData EncodingEncrypted Channel
Software
NICECURL · TAMECAT