G1044: APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.CitationMandiant APT42-charms The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.CitationMandiant APT42-charms APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.CitationMandiant APT42-charms Finally, APT42 exfiltrates data using native features and open-source tools.CitationMandiant APT42-untangling
APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
Security context for executives and security teams
APT42 matters because ATT&CK describes it as an Iranian-sponsored espionage and surveillance group that begins operations through spearphishing emails and/or PINEFLOWER Android malware, then monitors, collects, and exfiltrates information using native features and open-source tools. For leaders, the decision value is not a single malware name; it is whether the organization can detect and investigate phishing-led compromise, credential and MFA interception, endpoint persistence, cloud/SaaS data access, mailbox artifact removal, and web-based command-and-control before sensitive information leaves the environment.
Executive priority
Prioritize this as an intelligence-led readiness scenario for organizations with exposure to Middle East-related operations, sensitive personal or political information, cloud document repositories, executive communications, or high-value identities. Ask whether security programs can produce evidence for: phishing investigation, identity compromise response, MFA/session cookie abuse, endpoint execution using PowerShell/VBScript/WMI/scheduled tasks, and cloud or mailbox data access. This object supports budget and control discussions around managed detection, incident response playbooks, identity and access management, cloud/SaaS logging, and compliance evidence for data access and exfiltration review.
Technical view
ATT&CK provides no standalone detection guidance for APT42, so defenders should validate coverage through the related software and techniques. NICECURL is described as a VBScript-based backdoor used to download additional modules, and TAMECAT is described as malware used to execute PowerShell or C# content. The relationship set points SOC teams toward Windows execution and persistence behaviors such as PowerShell, Visual Basic, WMI, scheduled tasks, registry modification, and boot/logon autostart, plus discovery of system, network, local account, and security software information. It also points to collection and credential-access behaviors including keylogging, screen capture, MFA interception, session cookie theft, cloud storage access, mailbox data clearing, and web-protocol or web-service C2 using standard encoding.
Likely telemetry
- Email security and mailbox audit logs for spearphishing investigation and mailbox data deletion or export activity
- Endpoint process, command-line, script, and PowerShell telemetry, especially for VBScript, PowerShell, C# execution patterns, WMI, scheduled tasks, and registry changes
- Windows event logs and EDR records covering persistence, execution, discovery commands, and security software discovery
- Identity provider and MFA logs for unusual authentication flows, MFA interception indicators, session reuse, and anomalous access
- Browser, SaaS, and Office Suite logs for session cookie-related access patterns and cloud storage data access
Detection direction
- Because ATT&CK does not provide official detection text for this group, build detections from the related techniques rather than from the group name alone.
- Tune for suspicious combinations: phishing or mailbox activity followed by script execution, discovery commands, persistence creation, credential/MFA anomalies, cloud storage access, and web-based outbound traffic.
- Validate Windows coverage for PowerShell, VBScript, WMI, scheduled tasks, registry modification, and boot/logon autostart because the related software NICECURL and TAMECAT are Windows-associated.
- Review cloud and SaaS visibility for Data from Cloud Storage and Steal Web Session Cookie scenarios; endpoint-only monitoring will miss important parts of the described behavior.
- Include false-positive handling for legitimate administration tools and web services. WMI, scheduled tasks, PowerShell, registry changes, and common web protocols are normal in many environments, so detections should use context such as user role, host baseline, parent process, timing, and follow-on activity.
Mitigation priorities
- Start with identity and email controls: phishing-resistant processes where feasible, strong MFA governance, conditional access, rapid account revocation workflows, and alertable mailbox audit coverage.
- Harden and monitor script and administrative execution paths, including PowerShell, VBScript, WMI, scheduled tasks, registry persistence, and boot/logon autostart locations.
- Ensure cloud and SaaS repositories have auditable access, download, sharing, and export controls, with retention sufficient for incident response and compliance evidence.
- Prepare IR playbooks for suspected espionage-style intrusions: preserve endpoint, mailbox, identity, SaaS, and network evidence before artifacts can be removed or mailbox data cleared.
- Reduce impact of credential and session theft through session management, device trust policies, least privilege, and review of high-value account access to cloud storage and sensitive communications.
Additional notes and limits
The most useful defensive framing is a cross-domain intrusion scenario: phishing-led access, endpoint script execution, persistence and discovery, credential/session/MFA targeting, collection from endpoints and cloud storage, and exfiltration through native features or open-source tooling. The relationship context is richer than the group object itself and should drive validation priorities for SOC, IR, IAM, and cloud security teams.
The supplied ATT&CK group object has no platforms, tactics, labels, or official detection text. Platform and tactic guidance here is derived only from the listed related techniques and software. Local exposure, targeting relevance, active activity, and detection coverage cannot be inferred from this object alone and require organization-specific telemetry and threat intelligence validation.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.CitationMandiant APT42-charms The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.CitationMandiant APT42-charms APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.CitationMandiant APT42-charms Finally, APT42 exfiltrates data using native features and open-source tools.CitationMandiant APT42-untangling
APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.