APT42

State-sponsored cyber threat groupTrackedPending verification

CyberIRN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeState-sponsored cyber threat group

ProliferationOrigin country only

Active since2015At least 2015Med^[1]

MITRE ATT&CK IDG1044High^[1]

Capabilities

ATT&CK techniques used33ATT&CK v20.1High^[1]

Malware and toolsNICECURL, TAMECAT2 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorIranian state-sponsoredHigh^[1]

TargetsThe group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.Med^[1]

Notes

APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, APT42 exfiltrates data using native features and open-source tools. APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Iran

Sources

APT42, Group G1044, MITRE ATT&CK
Published/updated 2026-09-22 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1044)