The Bottom Line Upfront

APT42, an Iranian state-backed hacking group, is using social engineering tactics to infiltrate target networks and cloud environments by posing as journalists and event organizers.

The Breakdown

  • The group targets Western and Middle Eastern NGOs, media organizations, academia, legal services, and activists. They harvest credentials and use them to gain access to cloud environments, covertly exfiltrating data of strategic interest to Iran.
  • APT42, also known as Damselfly and UNC788, is an Iranian state-sponsored cyber espionage group affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC).
  • APT42 conducts information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.
  • The hacking group's social engineering schemes and credential harvesting operations enable them to gain access to target networks and exfiltrate data. Organizations need to enhance their cybersecurity measures to defend against such sophisticated threats.