By 
The state-sponsored advanced persistent threat (APT) actor named APT42 (formerly UNC788) has been attributed to over 30 confirmed espionage attacks against individuals and organizations of strategic interest to the Iranian government at least since 2015.
According to cybersecurity firm Mandiant, the group operates as the intelligence gathering arm of Iran's Islamic Revolutionary Guard Corps (IRGC), and also shares partial overlaps with another cluster called APT35, which is also known as Charming Kitten, Cobalt Illusion, ITG18, Phosphorus, TA453, and Yellow Garuda.
APT42 has shown a tendency to strike various industries such as non-profits, education, governments, healthcare, legal, manufacturing, media, and pharmaceuticals spanning at least 14 countries, including in Australia, Europe, the Middle East, and the U.S.
APT42 uses highly targeted spear-phishing and social engineering techniques designed to build trust with their victims in order to access their personal or corporate email accounts or to install Android malware on their mobile devices.
The main aim of the gang is to steal credentials, enabling the threat actor to leverage the access to conduct follow-on compromises of corporate networks to gather sensitive data and use the breached accounts to phish additional victims.
Attack chains involve a mix of highly targeted spear-phishing messages aimed at individuals and organizations of strategic interest to Iran. They also aim to build trust with former government officials, journalists, policymakers, and the Iranian diaspora abroad with the view of distributing malware.
APT42 is also known to impersonate journalists and other professionals to engage with the victims for several days or even weeks before sending a malicious link.
Surveillance operations involve the distribution of Android malware such as VINETHORN and PINEFLOWER via text messages that can record audio and phone calls, extract multimedia content and SMSes, and track geolocations. A VINETHORN payload spotted between April and October 2021 masqueraded as a VPN app called SaferVPN.
The researchers noted that the use of Android malware to target individuals of interest to the Iranian government provides APT42 with a productive method of obtaining sensitive information on targets, including movement, contacts, and personal information.
The group is known to have used lightweight Windows malware from time to time – a PowerShell toehold backdoor named TAMECAT, a VBA-based macro dropper dubbed TABBYCAT, and a reverse shell macro known as VBREVSHELL – to augment their credential harvesting and espionage activities.
APT42's links to APT35 stems from links to an uncategorized threat cluster tracked as UNC2448, which Microsoft (DEV-0270) and Secureworks (Cobalt Mirage) disclosed as a Phosphorus subgroup carrying out ransomware attacks for financial gain using BitLocker.
While APT35 is oriented towards long-term, resource-intensive operations targeting different industry verticals in the U.S. and the Middle East, APT42's activities focus on individuals and entities for domestic politics, foreign policy, and regime stability purposes.
