IranAttributedIRGC Intelligence OrganizationEspionageActive 2015 – 2025APT42
Also known asUNC788
Summary
Iranian state-sponsored espionage and surveillance group, active since at least 2015 and previously tracked by Mandiant as UNC788. Mandiant assesses with moderate confidence that it operates on behalf of the IRGC Intelligence Organization (IRGC-IO). MITRE tracks it as G1044, separately from Magic Hound/APT35 (G0059): the two share behaviour and some software, but the originating vendor tracks them as distinct, and several vendor names (TA453, Mint Sandstorm, Educated Manticore, Charming Kitten, Yellow Garuda) cover activity of both, so they are not listed as APT42 aliases here. Targets individuals and organisations of interest for Iranian domestic politics, foreign policy and regime stability — government officials, NGOs, media, academia, legal services, activists and political campaigns — through rapport-building social engineering, credential harvesting against personal and Microsoft 365 accounts, custom Windows backdoors (NICECURL, TAMECAT) and Android surveillance malware (PINEFLOWER, VINETHORN). In the SpearSpecter campaign (Israel National Digital Agency, Nov 2025) operators contacted senior defence and government officials and their families over WhatsApp, delivered LNK files through search-ms/WebDAV lures and ran TAMECAT with Telegram and Discord C2.
Attribution
IRGC-IO
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- Israel National Digital Agency (Government, 2025-11-14)
Attributes the SpearSpecter campaign to APT42, operating for the IRGC-IO (high confidence) - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Iranian-sponsored - Mandiant (Research, 2022-09-07)
Moderate confidence: operates on behalf of the IRGC Intelligence Organization
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| SpearSpecter | 2025-09 – ongoing | Israel | Government, Defense | Israel National Digital Agency (2025-11) |
| Gemini misuse for target reconnaissance, rapport-building lures and tool development (disrupted by Google) | 2025 | Israel, USA, Global | Think Tanks, Government, Defense | Google Threat Intelligence Group (2025-01-29; 2025-11-05; 2026-02-12) — Jan 2025: content tailored to a US defense organization; Nov 2025: continued research into Israeli defense |
| Israel/US official and election-campaign phishing | 2024-02 – 2024-07 | Israel, USA | Government, Political Campaigns, Diplomacy | Google TAG (2024-08-14) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 18
| Reconnaissance1 | T1682Query Public AI Services |
|---|---|
| Resource Development2 | T1585.002Email AccountsT1583.001Domains |
| Initial Access1 | T1566.002Spearphishing Link |
| Execution1 | T1059.001PowerShell |
| Persistence1 | T1547Boot or Logon Autostart Execution |
| Stealth3 | T1684.001ImpersonationT1070.008Clear Mailbox DataT1070Indicator Removal |
| Credential Access4 | T1111Multi-Factor Authentication InterceptionT1539Steal Web Session CookieT1555.003Credentials from Web BrowsersT1697Steal Application Specific Passwords |
| Collection2 | T1530Data from Cloud StorageT1056Input Capture |
| Command and Control3 | T1102Web ServiceT1132.001Standard EncodingT1573.002Asymmetric Cryptography |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| NICECURL | VBScript backdoor (downloads additional modules) | Windows |
| TAMECAT | PowerShell toehold/backdoor executing PowerShell or C#; HTTPS, Telegram and Discord C2 | Windows |
| PINEFLOWER | Android surveillance malware | Android |
| VINETHORN | Android backdoor masquerading as a VPN app | Android |
| POWERPOST | PowerShell reconnaissance tool (system info, local accounts) | Windows |
| GHAMBAR | RAT with SOAP-over-HTTP C2 (keylogging, screen capture) | Unknown |
Infrastructure patterns
- Typosquat think-tank domains — understandingthewar[.]org, brookings[.]email (Google TAG, 2024)
- Malicious Google Sites pages and ngrok redirect URLs funnel targets to its phishing kit (Google TAG, 2024)
- TAMECAT C2 over Telegram and Discord, first recorded in the SpearSpecter campaign (Israel National Digital Agency, 2025)
- Cloud staging: somee.com, Scalingo "filenest", Tebi S3, Cloudflare Workers, Firebase (Israel National Digital Agency, 2025)
- Dropbox-hosted PDFs carrying URL-shortener links to credential-harvesting pages (Mandiant, 2022)
Reporting and advisories 4
- Israel National Digital Agency
SpearSpecter - Google TAG
Israel/US official and election-campaign phishing - Google Threat Intelligence Group
Gemini misuse for target reconnaissance, rapport-building lures and tool development (disrupted by Google) - MITRE ATT&CK
APT42 (G1044) group profile