Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT42 · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT42

  • UNC788
  • CALANQUE
  • CALANQUE ION

state sponsor · Iran (Islamic Republic of)MITRE G1044 ↗

APT42 — ATT&CK roseAP

attack rose · 32 techniques across 11 tactics

Analyst brief

misp-galaxy + mitre-attack

Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.

Observed targets (as stated by the sources)

3 countries · 13 sectors
AustraliaIsraelUnited StatesAssessed origin: Iran

assessed origin · Iranobserved targets · 3

countries · 3

  • Australia
  • Israel
  • United States

sectors · 13

  • Education
  • Government
  • Military
  • Defense
  • Energy
  • Finance
  • Healthcare
  • Pharmaceuticals
  • Civil Society
  • Legal
  • Manufacturing
  • Media
  • NGOs

also stated: Europe, Middle East

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

32 techniques · 11 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    5 techniques

  3. Initial access

    1 technique

  4. Execution

    4 techniques

  5. Persistence

    1 technique

  6. Stealth

    4 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    3 techniques

  9. Discovery

    4 techniques

  10. Collection

    4 techniques

  11. Command and control

    4 techniques

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
NICECURLS1192 ↗
TAMECATS1193 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

6 sources
  1. 1.mandiant.com/resources/blog/apt42-charms-cons-compromises
  2. 2.services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cy…
  3. 3.cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-a…
  4. 4.attack.mitre.org/groups/G1044
  5. 5.services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromise…
  6. 6.cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-…

Track APT42 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.