Tracking APT42: Adversary Infrastructure Patterns & Credential Harvester Deployments

Executive Summary

APT42 is an Iranian state-sponsored cyber espionage operator associated with the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization. While many APT actors target corporate intellectual property or critical infrastructure, APT42’s mission focuses intently on surveillance, intelligence gathering, and tracking high-value individuals—including foreign policy specialists, think-tank analysts, human rights activists, and journalists.

In this research article, we analyze the infrastructure setup, social engineering lifecycle, and credential proxy mechanics observed across documented APT42 campaigns.

1. Tactical Staging & Infrastructure Lifecycle

The group’s infrastructure follows a recurring pattern designed to maximize operational lifespan while minimizing discovery across shared commercial threat feeds:

textCopy
Step 1: Domain Procurement
   - Registrar: Namecheap, Porkbun, or regional reseller
   - TLD: .com, .online, .site, .info
   - Naming: Masquerading as Google Meet, MS Teams, Oxford University, or Middle East Forum

Step 2: DNS & Hosting Configuration
   - Cloudflare CDN masking or direct VPS hosting (OVH, Hetzner, Stark Industries)
   - Dynamic SSL certificates provisioned via Let's Encrypt automated certbot

Step 3: Lure Staging
   - Customized reverse-proxy landing pages cloned from target portals
   - Parameterized URL tokens tied to individual target email hashes

Naming Conventions & Typosquatting

APT42 frequently incorporates target institution names combined with conference keywords or authentication verbs:

• join-meet-session[.]online
• oxford-academic-review[.]site
• mfa-verify-portal[.]com

2. The Phishing Workflow: Multi-Touch Social Engineering

Unlike bulk commodity phishing, APT42 conducts extended pre-operational reconnaissance:

1. Rapport Building: The operator initiates contact on WhatsApp, LinkedIn, or personal email posing as a journalist, academic researcher, or think-tank organizer.
2. Conversation Priming: Multiple benign emails or messages are exchanged over several days to establish credibility and overcome initial skepticism.
3. The Pivot: The operator sends a benign-looking link claiming to be an agenda document, draft manuscript, or video conference link.
4. Credential Harvesting: The link redirects to a customized credential harvester replicating the target's email provider (e.g., Google Workspace, Microsoft 365, Yahoo).

3. Reverse-Proxy & MFA Interception

A key analytical finding in recent reporting (including the July 2025 Check Point Research analysis) is the deployment of intermediate reverse-proxy kits (analogous to Modlishka or Evilginx architectures).

textCopy
Target User ───> [APT42 Reverse Proxy Harvester] ───> [Legitimate Google/M365 Identity Provider]
                       │                                         │
                       │ (Relays Credentials & TOTP)             │
                       ▼                                         ▼
                 [Harvest Credentials]                     [Valid Session Token Generated]
                       │                                         │
                       └────────── Intercept Session Cookie ─────┘

By acting as a Man-in-the-Middle (MitM) between the victim and the legitimate identity provider:

• The operator captures usernames and passwords in real-time.
• The proxy prompts the victim for their two-factor authentication (2FA) SMS code or Authenticator TOTP token.
• The proxy relays the token immediately to the real authentication endpoint and captures the resulting authenticated session cookie.

4. MITRE ATT&CK Behavioral Mapping

5. Defensive Mitigations & Detection Engineering

To counter APT42 infrastructure tactics, organizations should prioritize:

1. FIDO2 / WebAuthn Hardware Keys: Physical security keys (YubiKeys) bind cryptographic credentials to the specific origin URL in the browser address bar, completely neutralizing reverse-proxy phishing kits.
2. Newly Registered Domain (NRD) Inspection: Block or quarantine outbound connections to domains registered within the past 30 days.
3. Conditional Access Policies: Enforce device compliance and trusted IP boundaries so stolen session cookies cannot be replayed from unauthorized autonomous systems.