Apt42

APT42, also known as Charming Kitten, CharmingCypress, Storm-2035, Damselfly, Mint Sandstorm, TA453, and Yellow Garuda, is an Iran-nexus advanced persistent threat (APT) group that has been active in various cyberattacks. The group employs a range of tactics, techniques, and procedures (TTPs), such as sending links directly to victims' WhatsApp or Telegram accounts and engaging them in chats to manipulate through social engineering. These TTPs are commonly associated with Iranian APT groups like APT42 and Phosphorus. APT42's activities signify a prolonged, targeted attack on specific entities with the intent to compromise their systems and gain valuable information. The group has recently targeted Middle East policy experts in the region, the US, and Europe, using a fake webinar platform to compromise its victims, according to an advisory published by Volexity. In addition, APT42 has been implicated in attacks against individuals associated with both Democratic and Republican presidential campaigns. In one notable instance, the group used spoofed emails from the Institute for the Study of War (ISW) to invite victims to a fake podcast, ultimately delivering malware named BlackSmith via a malicious Google Drive link. On August 15, Google revealed that APT42 was attempting to compromise the email accounts of individuals associated with the respective US Presidential campaigns via spearphishing attacks. Since June 2024, Insikt Group has tracked infrastructure linked to GreenCharlie, another Iran-nexus cyber threat group with connections to Mint Sandstorm, Charming Kitten, and APT42. There has been a significant increase in cyber threat activity from GreenCharlie. Google attributed Iranian campaign hacking to APT42, which operates on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization. As tensions between Iran and Israel intensify, it is expected that APT42 will continue to launch increased campaigns, particularly focused on Israel and the U.S., demonstrating their sophisticated, persistent threat capabilities.