APT Profile: APT42 – Cyfirma

Short Summary:

APT42 is an Iranian state-sponsored cyber espionage group primarily focused on information collection and surveillance against individuals and organizations of strategic interest to Iran. Active since at least 2015, they employ targeted spear phishing and deploy mobile malware to gain access to sensitive information. Their operations are characterized by adaptability to Iran’s evolving priorities and a focus on entities opposing the Iranian government.

Key Points:

• Group Name: APT42 (also known as Mint Sandstorm, TA453, Yellow Garuda)
• Motivation: Espionage
• Targeted Countries: USA, Canada, UK, Germany, France, Middle East, Australia
• Active Since: At least 2015
• Techniques Used: Spear phishing, mobile malware deployment
• Recent Campaigns: Targeting organizations opposing Iran through social engineering and credential harvesting
• Notable Malware: NICECURL, TAMECAT
• Tools Used: CHAIRSMACK, GHAMBAR, POWERPOST, among others
• Recent Vulnerability Exploited: CVE-2023-38831

MITRE ATT&CK TTPs – created by AI

• Reconnaissance – T1595.002
  • Gathering information about targets to plan attacks.
• Execution – T1047
  • Using a command-line interface to execute commands.
• Defense Evasion – T1218.011
  • Bypassing security mechanisms to avoid detection.
• Lateral Movement – T1021.001
  • Moving through a network to access additional systems.
• Collection – T1589.001
  • Gathering sensitive information from compromised systems.
• Credential Access – T1003.001
  • Harvesting user credentials for unauthorized access.
• Command and Control – T1071.001
  • Establishing a communication channel with compromised systems.
• Initial Access – T1098.002
  • Gaining initial access to target systems.
• Privilege Escalation – T1065
  • Gaining higher-level permissions on a system.
• Discovery – T1566.002
  • Identifying system and network information.

Published On : 2024-08-13

APT42 is an Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government. We estimate with moderate confidence that APT42 operates on behalf of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization (IRGC-IO) based on targeting patterns that align with the organization’s operational mandates and priorities.

Active since at least 2015, APT42 is characterized by highly targeted spear phishing and surveillance operations against individuals and organizations of strategic interest to Iran. The group’s operations, which are designed to build trust and rapport with their victims, have included accessing the personal and corporate email accounts of government officials, former Iranian policymakers or political figures, members of the Iranian diaspora and opposition groups, journalists, and academics who are involved in research on Iran. After gaining access, the group deployed mobile malware capable of tracking victim locations, recording phone conversations, accessing videos and images, and extracting entire SMS inboxes. APT42 has demonstrated the ability to alter its operational focus as Iran’s priorities evolve over time. We anticipate APT42 will continue to conduct cyber espionage operations in support of Iran’s strategic priorities in the long term based on its extensive operational history and imperviousness to public reporting and infrastructure takedowns.

Alias: APT42 Alias Mint Sandstorm, TA453, Yellow Garuda
Motivation: Espionage

Targeted Countries

USA, Canada, United Kingdom, Germany, France, Middle East, Australia

APT42 Campaigns Tracked by CYFIRMA

Malware used by APT 42
NICECURL,TAMECAT,NokNok

Tools used by APT42:
CHAIRSMACK, GHAMBAR, POWERPOST, BROKEYOLK, MAGICDROP, PINEFLOWER, TABBYCAT, TAMECAT, VBREVSHELL, VINETHORN, DOSTEALER

MITRE ATT&CK Techniques used by APT 42

Recently Exploited Vulnerabilities by APT 42 CVE-2023-38831

APT 42’s Recent Campaign Highlights and Trends

• In a recent campaign, threat actors from APT42 targeted organizations in Western and Middle Eastern countries through social engineering attacks. They impersonated journalists to gain the trust of their targets and infiltrated corporate networks and cloud environments. The attackers used malicious emails to deliver two custom backdoors, named Nicecurl and Tamecat, which allowed them to execute commands and steal sensitive data from the compromised systems.
• In recent campaigns, APT42 has predominantly focused on targeting entities that oppose Iran, including government and political bodies, media and journalism outlets, healthcare organizations, academic institutions, and non-governmental organizations (NGOs).
• APT42’s activities are not limited to direct cyber-attacks. The group also conducts extensive credential harvesting operations, intricately designed to appear as legitimate interactions. These operations are carried out through carefully crafted spear-phishing campaigns that often impersonate well-known news outlets or NGOs. For example, domains masquerading as major publications like The Washington Post and The Economist have been used to disseminate malicious links that redirect users to fake login pages, effectively stealing their credentials.
• Given APT42’s historical resilience and adaptability, it is expected that they will continue their cyber espionage operations in support of Iran’s strategic objectives, particularly as geopolitical dynamics evolve.

Source: Original Post