In an ongoing operation that public reporting tracks as SpearSpecter, APT42 operators identify a senior defense or government official, research them in depth, and then make contact with an invitation — to a prestigious conference, or to a strategic meeting. There is no payload in the first message, or the second, or often the tenth. Operators communicate for days or weeks over WhatsApp, building a relationship, before any malware is delivered.

If you read Post 2 of this series, you'll recognize the contrast immediately. MuddyWater is a volume actor that runs large phishing campaigns and blends into network traffic with legitimate tooling. APT42 is the opposite end of the Iranian spectrum: patient, personnel-driven, and increasingly able to compromise a target's cloud accounts without ever touching their endpoint.

This post explains how APT42 operates, why its tradecraft defeats the controls most enterprises lean on, and why a think-tank-and-journalists threat model already has named US victims.

» Strengthen your cybersecurity with KELA 

Who is APT42?

Unlike financially motivated actors, it pursues political, military, and intelligence objectives tied to Iranian state interests — long-term surveillance of adversaries, monitoring of targets, and suppression of perceived threats to the regime.

Its targeting is unusually specific.

APT42 systematically goes after government ministries, diplomatic missions, think-tanks, NGOs, academia, media, telecommunications, aerospace, and defense organizations. The individual is the real objective, and the organization is frequently just the vector.

Primary victims include foreign policymakers, senior defense and government officials, journalists covering the Middle East, researchers, and Iranian dissidents abroad.

In some cases the group widens its reach by targeting the family members of primary targets. Documented activity spans the Middle East, North America, Europe (with specific notes in Germany and the UK), and Central Asia.

» Understand  how threat actors breach and exploit your data

APT42 at a Glance

• Aliases: UNC788, CALANQUE, Mint Sandstorm, Charming Kitten (overlapping cluster)
• Operates from: Iran
• Sponsor / Backing: Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO)
• Active since: At least 2015
• Ideology / motivation: State-aligned political, military, and intelligence collection, with a focus on long-term surveillance of regime adversaries and the suppression of perceived threats to the Iranian state. The group is not financially motivated.

Signature Tactics, Techniques, and Procedures (TTPs)

• Multi-week social-engineering rapport-building
• Spear-phishing via LinkedIn, WhatsApp, and email
• TAMECAT fileless PowerShell backdoor
• OAuth consent and mailbox-rule abuse for malware-free cloud persistence
• Android surveillance implants
• Multi-channel C2 (Telegram, Discord, HTTPS) proxied through Azure and Cloudflare Workers

Notable Activity (2025–2026)

• SpearSpecter: Senior defense and government officials
• UNK_SmudgedSerpent: U.S. academics and think-tank staff
• Mega Model Agency impersonation: Iranian dissidents in Germany

For a Global 1000 security leader, the business impact is not data destruction or ransom. It is the quiet, prolonged compromise of executive identities, board-adjacent advisors, regional staff, and the cloud accounts they rely on.

APT42's shift toward malware-free cloud access means an intrusion can persist for months inside Microsoft 365 or Google Workspace with nothing for an endpoint product to detect. Any organization employing people in Middle East-related roles—including policy, journalism, defense, or regional leadership—carries exposure that traditional sector- and geography-based threat models will miss.

Here is the updated content, fully converted to US English (using "z" and standardized spelling) with improved, consistent H2 and H3 heading structures for readability.

A Decade of Patience: How the Targeting Evolved

APT42's defining characteristic is strategic patience, and its history reads as a series of adaptations to whatever Iran's intelligence priorities were at the time.

Diplomacy and Think-Tanks (2015–2019)

From its earliest documented activity, the group concentrated on Western think-tanks and academics researching Middle East policy, gathering intelligence on foreign diplomacy. This is the origin of the personnel-first targeting model that still defines it.

Pandemic Lures (2020–2021)

Exploiting global anxiety, APT42 leaned on COVID-19 themes to target healthcare, pharmaceutical research, and liberal-arts institutions — an opportunistic pivot that kept the same social-engineering core but swapped the pretext.

Mobile Surveillance and Joint Operations (2022-2024)

The group escalated its harassment of journalists and dissidents through heavy use of Android malware for personal surveillance — GPS, messages, contacts. During this period, it also conducted joint operations with other Iranian units, including MuddyWater and OilRig, making heavy use of RMM software against Israeli and Central Asian targets. The geopolitical framing is consistent throughout: lures tracked Iran's domestic unrest, economic pressure, and escalations in the Iran-Israel conflict, all chosen to compromise regional subject-matter experts.

That arc matters because it shows the constant. The pretext changes with the headlines; the method — find a specific high-value person, earn their trust, then exploit it — does not.

Latest Campaigns

SpearSpecter

The current flagship operation. Targets are senior defense and government officials, selected through deep reconnaissance and approached with conference invitations or strategic-meeting offers, followed by days-to-weeks of WhatsApp rapport before any malware is introduced.

The dwell time before compromise is itself the tradecraft: by the time a link arrives, the target has been conditioned to expect it.

UNK_SmudgedSerpent

A cluster that is not definitively attributed to APT42 but that researchers assess as overlapping or linked. It used carefully spoofed emails impersonating prominent foreign-policy experts — among them Suzanne Maloney and Patrick Clawson — to target US-based academics and think-tank personnel researching Iranian societal reform and IRGC militarization. This is the clearest recent signal that the think-tank threat model is a US threat model.

Mega Model Agency Impersonation

A fraudulent website mimicking a legitimate Hamburg-based model agency, hosting obfuscated JavaScript to fingerprint visitors and featuring a fictitious model profile ("Shir Benzion") with a private-album lure — aimed at Iranian dissidents and activists in Germany.

TTPs: How APT42 Operates

Tradecraft Summary

APT42's tradecraft sits in five tactical buckets. Full ATT&CK mapping and runnable hunt queries are in the appendix and the companion repository linked at the close of this post ([CIC repo]).

1. Initial Access and Social Engineering

Spear-phishing is the primary vector (T1566.002), but the defining feature is the rapport-building that precedes it. Operators cultivate relationships over LinkedIn, WhatsApp, and email, frequently posing as journalists, think-tank members, or recruiters. Only once trust is established do they deliver malicious links disguised as meeting documents, OnlyOffice collaboration URLs, or job applications (T1204.001). The group also abuses the Windows search-ms URI protocol handler alongside WebDAV servers to silently stage malicious .LNK shortcut files that appear to the victim as PDFs (T1204.002) — a technique that turns a single click on a "document" into remote payload retrieval.

» Want to understand how attackers weaponize legitimate remote access tools? Read our guide to the Initial Access Broker's Toolbox

2. Malware and Execution

The principal implant is TAMECAT, a modular, PowerShell-based backdoor that runs almost entirely in memory (T1059.001, T1620). It pulls payloads dynamically and supports multi-channel C2 over Telegram, Discord, and HTTPS. For mobile targets, the group deploys custom Android malware that tracks GPS location, messages, and contacts — surveillance tooling aimed squarely at the individual rather than the enterprise network.

3. Credential Access and Collection

This is where APT42's precision shows. To pull browser data without tripping file locks, TAMECAT exploits Microsoft Edge's remote debugging port (9222) in hidden mode to extract decrypted cookies, and uses the Sysinternals tool PsSuspend to freeze Chrome and safely copy locked SQLite databases (T1555.003, T1539). It spawns fraudulent system prompts via the CredUIPromptForWindowsCredentials function to harvest Outlook or Windows passwords (T1056.002), and the broader campaign set includes multi-factor-authentication interception (T1111). High-value data such as Outlook PST files is split into 1MB–5MB chunks using tools like Runs.dll or WinRAR to blend exfiltration into normal web traffic (T1030).

» Learn how leaked credentials differ from compromised accounts

4. Persistence and Cloud Infrastructure Abuse

This is the bucket that should reshape your threat model. APT42 maintains access to Google Workspace and Microsoft 365 without endpoint malware by abusing OAuth application consents (T1528), manipulating mailbox forwarding rules (T1114.003), and generating persistent cloud API keys. C2 is proxied through Azure cloud services and Cloudflare Workers (*.workers.dev) so that malicious traffic reads as legitimate enterprise communication (T1102, T1071.001). Where on-disk persistence is needed, the group leans on legitimate RMM software such as PDQConnect (T1219) or modifies Windows Registry Run keys (T1547.001) — one observed key named, with some irony, "Renovation."

5. Command, Control, and Exfiltration

The multi-channel design, Telegram, Discord, HTTPS, all fronted by reputable cloud providers — is built specifically to defeat IOC- and domain-reputation-based detection. There are no suspicious domains to block when the C2 endpoint is a workers.dev subdomain. Exfiltration runs over the same trusted channels (T1041), chunked to stay under traffic-anomaly thresholds.

The throughline across all five buckets: APT42 has engineered its way out of the artifacts most enterprises detect on. Fileless execution removes the disk artifact. Cloud-consent abuse removes the endpoint entirely. Reputable-provider C2 removes the network IOC. What remains is behavior and identity — which is exactly where detection has to move.

» Make sure you understand the  most targeted entry points by attackers

Sectors and Victimology

By sector, the group systematically targets government ministries, diplomatic missions, think-tanks, NGOs, academia, media outlets, telecommunications, aerospace, and defense organizations. But victimology is the more important lens: the primary focus is high-profile individuals — foreign policymakers, senior defense and government officials, journalists covering the Middle East, researchers, and Iranian dissidents abroad. The organization is frequently the means, not the end, and in some cases the group widens the attack surface by going after the family members of primary targets.

Geographically, documented activity spans the Middle East, North America, Europe — with specific notes in Germany and the UK — and Central Asia.

That population includes people who do not look like classic APT targets: a policy researcher on a corporate advisory board, a journalist on staff, a regional executive, a recently hired academic. Each is a doorway, and APT42 is patient enough to use it.

Three Takeaways for the U.S. Enterprise

1. Identity Is the Control Surface Because the Endpoint May Never Be Touched

The single most important shift APT42 forces is the recognition that a serious intrusion can run entirely in your cloud tenant. OAuth application-consent abuse, malicious mailbox-forwarding rules, and persistent cloud API keys produce no endpoint malware for EDR to find.

The defensive priorities follow directly:

• Stringent OAuth app-consent review and restriction
• Phishing-resistant (FIDO2/hardware-key) MFA rather than push or OTP
• Conditional-access policies
• Alerting on new mailbox-forwarding rules and anomalous API-key creation
• Monitoring for the specific browser-cookie-theft behaviors TAMECAT uses (hidden Edge remote-debugging sessions on port 9222 and PsSuspend against browser processes)

2. The Person Is the Attack Surface, Not the Perimeter

APT42's multi-week rapport-building is designed to defeat the assumption behind most phishing defenses—that a malicious message arrives cold from a stranger. By the time the link lands, the relationship feels real and the email gateway has nothing to flag.

The actionable question is: "Who in our organization has a Middle East-relevant public profile?"

That includes people working in:

• Policy
• Journalism
• Defense
• Regional leadership

The answer should drive targeted hardening, executive-protection-grade awareness, and, where appropriate, extending that posture to family members and personal devices, which the group has shown it will use as a vector.

3. The U.S. Precedent Already Exists

Don't wait for your own incident to model the threat.

The UNK_SmudgedSerpent cluster's impersonation of named foreign policy experts to target U.S. academics and think-tank staff is not a hypothetical; it is the documented present. Whether or not that specific cluster is APT42 in the final attribution, the targeting pattern is squarely within the group's playbook and squarely aimed at U.S. soil.

Any organization that employs, funds, or convenes Middle East expertise should assume it is in scope and build identity-aware, person-centric defenses before the first conference invitation arrives.

» Reasons you need cyber threat intelligence

Discover & Defend Against Sophisticated Adversaries

Discover how KELA helps organizations uncover, prioritize, and mitigate advanced threats with actionable cyber threat intelligence

Contact Us

Coming Next

Next in the series, Prince of Persia (Infy), the decade-old surveillance actor whose tooling now reaches victims across more than twenty countries, and whose C2 went dark on the exact day Iran's January 2026 internet blackout began.

KELA's Cyber Intelligence Center provides finished intelligence and threat-actor monitoring for Global 1000 and Government security teams as part of our platform offering.

For tailored solution introduction and and briefings on the Iranian threat picture in your sector or geography, contact our team of experts at sales@ke-la.com or for KELA customers reach out to your Customer Success Representative.