APT42
- ID
- G1044
- Source
- attack.mitre.org
- MITRE last modified
- 23 Sep 2026
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.[1] The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.[1] APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.[1] Finally, APT42 exfiltrates data using native features and open-source tools.[2]
APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
Techniques used (33)
- T1016 System Network Configuration Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1056 Input Capture
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1070 Indicator Removal
- T1070.008 Clear Mailbox Data
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1087.001 Local Account
- T1102 Web Service
- T1111 Multi-Factor Authentication Interception
- T1112 Modify Registry
- T1113 Screen Capture
- T1132.001 Standard Encoding
- T1518.001 Security Software Discovery
- T1530 Data from Cloud Storage
- T1539 Steal Web Session Cookie
- T1547 Boot or Logon Autostart Execution
- T1555.003 Credentials from Web Browsers
- T1566.002 Spearphishing Link
- T1573.002 Asymmetric Cryptography
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1585.002 Email Accounts
- T1588.002 Tool
- T1608.001 Upload Malware
- T1682 Query Public AI Services
- T1684.001 Impersonation
- T1697 Steal Application Specific Passwords