Tehran went phishing. In September 2021, the Iranian state-sponsored cyber espionage group known as APT42 used a compromised European government email account to send a phishing email to almost 150 addresses.
- They targeted individuals and entities employed by, or affiliated with, civil society, government or intergovernmental organisations around the world, according to a Mandiant report.
- As a company spokesperson told our sister website, some of the targets were individuals and organisations based in Italy.
Tracing it back to the State. Mandiant assesses with high confidence that APT42 is an Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organisations of strategic interest to the Iranian government.
- “We further estimate with moderate confidence that APT42 operates on behalf of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization (IRGC-IO) based on targeting patterns that align with the organisation’s operational mandates and priorities.”
A portrait of the cybercriminals. Active since at least 2015, APT42 is characterised by highly targeted spear-phishing techniques. The group’s operations, which are designed to build trust and rapport with their victims, have included accessing the personal and corporate email accounts of government officials, former Iranian policymakers or political figures, members of the Iranian diaspora and opposition groups, journalists, and academics who are involved in research on Iran.
- After gaining access, the group deployed mobile malware capable of tracking victim locations, recording phone conversations, accessing videos and images, and extracting entire SMS inboxes.
- It has a demonstrated ability to alter its operational focus as Iran’s priorities evolve over time.
Mandiant’s warning. “We anticipate APT42 will continue to conduct cyber espionage operations in support of Iran’s strategic priorities in the long term based on their extensive operational history and imperviousness to public reporting and infrastructure takedowns.”
