Apt42

APT42, also known as Charming Kitten and CharmingCypress, is an Iran-nexus advanced persistent threat (APT) group known for its sophisticated and persistent cyber-attack strategies. The group has recently targeted Middle East policy experts in the region, as well as in the US and Europe, using a phony webinar platform to compromise its targeted victims. This tradecraft is common among APT groups like APT42 and Phosphorus, with TAG-56 illustrating many of the known tactics, techniques, and procedures (TTPs) associated with these groups. Some operators have been known to send links directly to victims' WhatsApp or Telegram accounts, manipulating them through social engineering. In August, Google revealed that APT42 attempted to compromise the email accounts of individuals associated with the respective US Presidential campaigns via spearphishing attacks. The attackers used spoofed emails from the Institute for the Study of War (ISW) to invite the victim to a fake podcast, ultimately delivering malware named BlackSmith via a malicious GoogleDrive link. Google's research attributed Iranian campaign hacking to APT42, which operates on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization. Since June 2024, Insikt Group has tracked infrastructure linked to GreenCharlie, another Iran-nexus cyber threat group with connections to Mint Sandstorm, Charming Kitten, and APT42. There has been a significant increase in cyber threat activity from GreenCharlie. APT42 has shown the ability to run numerous simultaneous phishing campaigns, particularly focused on Israel and the U.S. In the last six months, Google successfully disrupted the use of Google Sites in over 50 campaigns carried out by APT42. The group uses social engineering tactics to trick targets into setting up video meetings, leading to phishing pages.