APT42 Tracker

An open research repository tracking APT42, an Iranian state-linked cyber espionage threat group, organizing reported TTPs and mapping observed behavior to the MITRE ATT&CK framework.

GitHub repository

Problem statement

Threat reporting on sophisticated espionage actors is often distributed across disjointed vendor whitepapers, PDF advisories, and indicator dumps. Security teams lack a centralized, open research reference that correlates documented campaigns, infrastructure patterns, and MITRE ATT&CK mappings while preserving source traceability.

Motivation and intended users

To build a structured understanding of APT42’s targeting patterns, surveillance toolsets, and credential-harvesting workflows, while establishing a rigorous analytical methodology for tracking adversary infrastructure over time.

Technologies and stack

Threat IntelligenceMITRE ATT&CKOSINTAdversary TrackingMarkdownGit

Relevant MITRE ATT&CK techniques:

T1566.002Spearphishing Link T1583.001Acquire Infrastructure: Domains T1056.003Input Capture: Web Portal Credential Harvester T1071.001Application Layer Protocol: Web Protocols T1539Steal Web Session Cookie

APT42 Threat Actor Profile & Research Dossier

Threat Actor Overview

APT42 is an Iranian state-linked cyber espionage group characterized by highly targeted social engineering, credential harvesting, and mobile surveillance campaigns. Their operations primarily target civil society figures, policy analysts, academic researchers, foreign affairs specialists, and dissidents.

Unlike disruptive groups focused on destructive wipers or financial theft, APT42 operates with high operational discipline, dedicating substantial resources to building rapport with targets over messaging applications before delivering malicious payloads.

text
[Target Identification] 
       ↓ (OSINT / Social Media Reconnaissance)
[Personalized Outreach] 
       ↓ (WhatsApp / Signal / Email impersonation)
[Lure Delivery: Invitation / Document Review]
       ↓
[Credential Harvester Landing Page] (Mirroring Google / Microsoft / Yahoo login)
       ↓
[Session / Token Interception + Reverse Proxy / 2FA Bypassing]
       ↓
[Mobile Surveillance Implant Delivery / Persistent Mailbox Access]

Research Objectives

Systematic TTP Mapping: Connect reported adversary actions to MITRE ATT&CK Enterprise techniques.
Infrastructure Analysis: Identify patterns in domain registrations, name servers, and hosting providers utilized for staging credential harvesters.
Source Traceability: Maintain a verifiable ledger linking each indicator and technique to its original source report.

Documented Tactics, Techniques, & Procedures (TTPs)

Tactic	Technique ID	Technique Name	Documented APT42 Procedure
Initial Access	`T1566.002`	Spearphishing Link	Employs spoofed domain links resembling conference invitations, book manuscript reviews, and interview requests.
Resource Development	`T1583.001`	Domains	Registers typosquatted domains imitating target institutions, webmail portals, and URL shorteners.
Credential Access	`T1056.003`	Web Portal Credential Harvester	Deploys customized phishing kits imitating Google, Yahoo, and Microsoft 365 authentication flows.
Collection	`T1539`	Steal Web Session Cookie	Utilizes proxy-based interception to harvest active session tokens and bypass SMS-based multi-factor authentication.
Command & Control	`T1071.001`	Web Protocols (HTTPS)	Communicates with C2 servers over standard TLS-encrypted HTTPS connections on port 443.

Source Register & Verification Notice

Note on Intelligence Confidence: The indicators and threat models documented in this repository are derived from vendor research publications (including Check Point Research and Mandiant Intelligence). This project does not execute intrusive network operations; all indicators are cataloged for defensive threat hunting and perimeter rule construction.

Key features and decisions

›Structured actor profiling covering attribution context, operational mandate, and historical targeting.
›Comprehensive MITRE ATT&CK mapping across Initial Access, Execution, Persistence, and Credential Access.
›Integration of credible third-party reporting, including Check Point Research (July 2025 analysis).
›Distinction between independently verified indicators and external vendor claims.
›Traceable source bibliography with explicit confidence scoring for analytical claims.

Challenges and limitations

!Attribution relies on public reporting from threat intelligence vendors rather than proprietary telemetry.
!Documented infrastructure is ephemeral; domains and VPS nodes are regularly recycled or abandoned.
!The repository is an analytical research archive, not an automated real-time ingestion engine.