APT42: Iran-Backed Advanced Threat Operations
In the cybersecurity world, some advanced persistent threats (APTs) leak data, crash systems, and leave traces behind. But some are silent — roaming a network undetected for months without a single alarm going off, exfiltrating data and observing their target's behavior. One of these dangerous groups, which has ramped up its activity in recent years, is APT42. This blog post examines APT42's operations, techniques, and attacks against various sectors.
Who Is APT42? An Overview
Also known by many aliases such as Charming Kitten, Charming Cypress, TA453, Yellow Garuda, Phosphorus and Mint Sandstorm, APT42 is an Iranian state-sponsored threat actor operating since 2015, tied to the Islamic Revolutionary Guard Corps Intelligence and Security Command (IRGC-ISC).
This group's targets are generally:
- Think tanks in the Middle East and the West,
- Journalists, researchers, political advisors,
- And especially academic circles that engage with — and are seen as a threat to — Iranian policy.
In its phishing campaigns, APT42 uses unusual, advanced social-engineering tactics such as holding lengthy email conversations with targets before sending any malicious content links. APT42 has been observed impersonating journalists and event organizers to build trust with victims through sustained correspondence and to send invitations to conferences or legitimate documents, then creating a fake, tailor-made webinar platform / news site (spear phishing) through which victims' information is captured and their systems are compromised.
Attack Methods and Techniques
APT42 uses a multi-stage attack methodology that relies heavily on social engineering and exploitation. Let's examine these in detail:
- Social Engineering and Initial Access
- Credential Harvesting
- Persistence Mechanisms
- Technical Attack Vectors
Social Engineering and Initial Access
The group is known for building convincing social-engineering campaigns. To establish trust with the target audience, they usually create fake identities impersonating journalists, conference organizers or academic researchers, and their communications toward the target can go as far as building a relationship over email that lasts weeks or even months.
APT42 frequently uses event-based lures, inviting the target to fake webinars, conferences or interview opportunities. These invitations contain deceptive links that impersonate services like Microsoft 365, Google Meet and Zoom and redirect to credential-harvesting pages hosted on pre-prepared fake domains.
An Example From a Real Attack: A Fake Google Meet Page
A fake Google Meet page distributed by APT42
Do you notice anything odd when you first look at the image above?
In March 2023, APT42 sent a phishing email containing a fake Google Meet invitation to take over the accounts of Iranian journalists. This email was reportedly sent under the name of Mona Louri, likely a fake persona used by APT42.
During login, the user was shown a fake Gmail login page and asked to enter their credentials. Afterwards they were redirected to a Google Meet page. This information was then sent to the attackers. To increase its legitimacy, the fake page was hosted on the Google Sites (sites[.]google[.]com) web page builder, and — as can be seen in the figures below — a reference to a dedicated APT42 domain had been embedded in its HTML content. This attack attempt was also made public on Twitter.
Through fake user emails and interfaces, APT42 has successfully deceived a large number of users by impersonating the email and cloud services of many major organizations such as Dropbox, YouTube, Yandex, Yahoo and Microsoft.
We won't cover all the details of these attacks in this blog post, but if the subject interests you, you can find more information about the attacks carried out by the APT42 group in the article published by Google.
Credential Harvesting
After a successful spear-phishing attack, the main goal at this stage is to seize victims' usernames, passwords and session data in order to access systems as an authorized user. So what does APT42 do at this stage?
When victims enter their credentials, APT42 captures them in real time and usually applies adversary-in-the-middle (AitM, etc.) techniques to bypass multi-factor authentication. Once login is achieved, session cookies and authentication data are stolen, so that they could maintain their access even if the user changed their password.
Persistence Mechanisms
After successfully infiltrating the system, APT42's next goal is to make its access persistent and to maintain a long-term unauthorized presence. Thanks to the methods applied at this stage, the attacker can retain access even if the system is restarted. This creates the potential for deeper and more lasting damage.
APT42 uses specially developed backdoors to establish long-term persistence in the system.
Some of these are:
- POWERSTAR — a PowerShell-based backdoor
- POWERLESS — a script engine that evades PowerShell analysis
- NOKNOK — a macOS-based backdoor
- BASICSTAR — a remote code execution malware
- EYEGLASS — an information-gathering malware
Technical Attack Vectors
When attacking victims, APT42 uses a variety of complex attack methods to avoid being noticed and detected. Let's look at the attack tactics they frequently resort to and cover some of them in detail:
- Phishing links (Spear Phishing)
- Typo-squatted Domains
- Fake login/session pages
- Distribution of malicious RAR archives and LNK files (RAR + LNK Combo)
- Fake webinar platforms and malicious VPN applications
Typo-squatted Domains
APT42 registers fake domains by playing with the letters of organizations' domain names. Victims are redirected to these sites and, without realizing it, hand their login information to the attacker.
The most recent example of this is the Microsoft case we have seen a lot lately. Attackers mislead users by sending email from the visually similar address "@rnicrosoft[.]com" instead of the real domain "@microsoft[.]com".
RAR + LNK Combination Attack
The APT42 group has developed an unusual, complex RAR + LNK (Windows shortcut) combination method to infiltrate systems undetected. Now we will examine step by step how this technique works, and at the end of the post we will cover how it is applied in detail by carrying out a real attack example of this method.
An LNK file is a shortcut file used on Windows operating systems. It points to the location of the actual file, folder or application, and when the user clicks it the target content opens. For example, the browser icon on your desktop is a shortcut. Windows lets users create their own shortcut files and assign tasks to them. However, a relatively simple-looking capability — such as the ability to run other binaries on the system — can cause great harm when abused by threat actors.
LNK files that look normal
This method becomes quite effective when combined with social engineering:
- The attacker creates a RAR archive containing a malicious LNK file alongside normal-looking documents.
- The LNK file looks like a normal document (such as a PDF or Word file), but is actually a shortcut that runs hidden commands.
- When the victim opens and clicks the file they think is a document, the LNK file shows the user the promised document while running PowerShell commands in the background.
- These commands download and run malware from servers under the attacker's control.
The reasons this method is effective:
- When RAR files are encrypted, their contents may not be fully scanned.
- LNK files can be disguised with document icons and given double extensions, so they look normal.
- While the victim sees the expected content, the malware is loaded silently.
- Antivirus software may not thoroughly scan inside compressed archives.
This APT42 attack is also partly covered in the post published by Microsoft. Microsoft's analysis also includes technical details on how this method is used by advanced threat actors.
Malicious VPN Applications
APT42 occasionally uses the tactic of developing and distributing fake VPN applications to infiltrate target systems.
The attacker sends the target user a fake webinar or portal link. When the user logs into the portal through this link, the system checks the user's IP address.
If the IP address matches the target geographic locations or user profile the attacker has defined, the promised content is served to the user. But if the IP check fails, the attacker this time directs the user to download and use a fake VPN application they developed.
When the user runs the VPN application, the interface gives the impression of a legitimate service while the malware is activated in the background and the attack moves on to its next stage.
Indicators of Compromise (IOCs)
You can review the technical indicators (IOCs) associated with APT42 attacks — such as malicious files, domains and IP addresses — in the table below.
+------------------------------------------------------------------+--------+------------------------------------------+
| Indicator | Type | Context |
+------------------------------------------------------------------+--------+------------------------------------------+
| 464c5cd7dd4f32a0893b9fff412b52165855a94d193c08b114858430c26a9f1d | SHA256 | Dropper (Abraham Accords & MENA.pdf.lnk) |
| ddead6e794b72af26d23065c463838c385a8fdff9fb1b8940cd2c23c3569e43b | SHA256 | Archive (Abraham Accords & MENA.rar) |
| 1fb7f1bf97b72379494ea140c42d6ddd53f0a78ce22e9192cfba3bae58251da4 | SHA256 | NokNok Backdoor |
| e98afa8550f81196e456c0cd4397120469212e190027e33a1131f602892b5f79 | SHA256 | Applications NokNok Module |
| 5dc7e84813f0dae2e72508d178aed241f8508796e59e33da63bd6b481f507026 | SHA256 | Persistence NokNok Module |
| b6916b5980e79a2d20b4c433ad8e5e34fe9683ee61a42b0730effc6f056191eb | SHA256 | Processes NokNok Module |
| acfa8a5306b702d610620a07040262538dd59820d5a42cf01fd9094ce5c3487c | SHA256 | Informations NokNok Module |
| library-store[.]camdvr[.]org | Host | NokNok C2 |
| 144.217.129[.]176 | IP | NokNok C2 |
| filemanager.theworkpc[.]com | Host | Spoofed FTP Server website |
| fuschia-rhinestone.cleverapps[.]io | Host | GorjolEcho C2 |
+------------------------------------------------------------------+--------+------------------------------------------+
Detection and Analysis
In this section we proceed through a sample LNK malware obtained from MalwareBazaar, examining the attack step by step — what it does in the background, and how to detect it.
Information on the Malware We Will Examine
+ - - - - - - - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
| SHA256 hash: | 075d39cc0b27cbdb32eaffbf1a4536fdafc5238c7eba1e32c2001d9862e0fe7b |
+ - - - - - - - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
| File Name: | Offer Docuent.lnk |
| File Type: | .lnk |
+ - - - - - - - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
Any.Run Analysis
Any.Run is a sandbox environment that lets us analyze many file types and programs in real time. We drop our suspicious file into Any.Run and run it as the victim computer, and some logs appear live in our sandbox system.
The malware we extracted from the RAR file looks, at first glance from the outside, like a normal shortcut.
When we run the file, an ordinary document appears on screen. Now let's examine the ANY.RUN logs and reveal, step by step, what happens behind this "normal" appearance.
The graph shows the process chain launched when the user clicks the malicious file. When the file runs, PowerShell and mshta[.]exe are triggered in the background, and the payloads are executed from there.
Let's look at the details of the executed processes from the Process screen and which commands were run.
First, with the user's click, the file inside winrar[.]exe comes into play and copies itself to the C:\Users\admin\AppData\Local\Temp directory. In the Any.Run analysis this file was rated 100% Malicious.
Next, powershell[.]exe is launched as a child process of this file and downloads an .HTA file from "hxxps[://]eduaiqi[.]uz/wordpress/room5[.]hta". Right after the PowerShell process, mshta[.]exe comes into play and runs the downloaded room5[.]hta file, activating the second stage of the malware.
When I tried to access the downloaded file and the website, the domain was no longer reachable, so I couldn't get to the payload directly from the URL; instead I accessed the file in question by looking at urlscan.io's past scans.
The file downloaded by "Offer Document.lnk" was a malicious HTML Application file called room5[.]hta. This file contains obfuscated VBScript code. Obfuscation is a technique used in software development to make code harder for humans or computers to understand. With this method, attackers try to hide malware from antivirus software.
room5[.]hta is a file that uses its obfuscated VBScript to build and run a hidden PowerShell command. When the PowerShell code is de-obfuscated and examined, it is seen to download and run a remote file from the link "eduaiqi[.]uz/wordpress/rooma[.]exe".
Since the domain is not active, I again try to reach the old scans on urlscan.io and find our malware's hash value.
The hash value found for the room[.]exe file: 77e14caae3daf05c1f5a6a3d10e4936cc58944d6ae9ec6943b1be6d995e94b5c
Even though we don't have the original file, when we submit the hash value we found to VirusTotal, an interesting result comes up:
Looking at the VirusTotal analysis of the last file the program downloaded, the file is detected as malware by security engines at a high rate of 60/72.
Conclusion
Advanced threat actors like APT42 combine technical methods with social engineering and can stay inside undetected for a long time, so defense should not be limited to antivirus scans alone. Continuous threat monitoring, watching for suspicious compressed files and shortcuts, and blocking visually similar fake domains and phishing links increase the chances of detecting and neutralizing these kinds of silent, targeted attacks early.
For more technical details and APT42's known TTPs, you can review the MITRE ATT&CK page.
References
- Google Cloud Threat Intelligence Group. Untangling Iran: APT42 Operations.
- Volexity. Charming Cypress: Innovating Persistence
- Microsoft Security Blog. New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs.
- MITRE ATT&CK. "APT42 (G1044)."
- Vectra AI. APT42 Threat Actor Profile.