Home / Threat actors / APT42

APT42 G1044

🔔 Create alert

Updated at source on Sep 22, 2026 · View on MITRE ATT&CK

0

associated CVEs

39

Techniques

2

Malware and tools

APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, APT42 exfiltrates data using native features and open-source tools.

APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1682 Query Public AI Services

Resource Development

T1583.001 Domains T1583.003 Virtual Private Server T1585.002 Email Accounts T1588.002 Tool T1608.001 Upload Malware

Initial Access

T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.005 Visual Basic

Persistence

T1053.005 Scheduled Task T1112 Modify Registry T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1053.005 Scheduled Task T1547 Boot or Logon Autostart Execution

Stealth

T1036.005 Match Legitimate Resource Name or Location T1070 Indicator Removal T1070.008 Clear Mailbox Data T1684.001 Impersonation

Defense Impairment

T1112 Modify Registry

Credential Access

T1056 Input Capture T1056.001 Keylogging T1111 Multi-Factor Authentication Interception T1539 Steal Web Session Cookie T1555.003 Credentials from Web Browsers T1697 Steal Application Specific Passwords

Discovery

T1016 System Network Configuration Discovery T1082 System Information Discovery T1087.001 Local Account T1518.001 Security Software Discovery

Collection

T1056 Input Capture T1056.001 Keylogging T1113 Screen Capture T1530 Data from Cloud Storage

Command and Control

T1071.001 Web Protocols T1102 Web Service T1132.001 Standard Encoding T1573.002 Asymmetric Cryptography

Malware and tools

NICECURLMalwareS1192
TAMECATMalwareS1193

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.