#APT42

Miguel Afonso Caetanoremixtures@tldr.nettime.org
2025-04-24

"The office of Hannah Neumann, a member of the German Greens and head of the delegation spearheading work on European Union-Iran relations, was targeted by a hacking campaign that started in January, she said. Her staff was contacted with messages, phone calls and emails by hackers impersonating a legitimate contact. They eventually managed to target a laptop with malicious software.

"It was a very sophisticated attempt using various ways to manage that someone accidentally opens a link, including putting personal pressure on them," Neumann said.

Neumann was made aware of the ongoing ploy four weeks ago by the German domestic intelligence service, she said.

The group thought to be behind the attack is a hacking collective associated with the Iranian Revolutionary Guard, known as APT42, according to a report by the Parliament’s in-house IT service DG ITEC and seen by POLITICO. Another Iranian hacking group, called APT35 or Charming Kitten, was initially considered a culprit too. The two Iranian threat groups are closely related."

politico.eu/article/european-p

#EU #Germany #Iran #CyberSecurity #StateHacking #Spyware #APT42 #APT35

2025-04-23

APT42, eine Hackereinheit, die sehr wahrscheinlich von den iranischen Revolutionsgarden gesteuert wird, attackiert die Abgeordnete des EU-Parlaments und Leiterin der Iran-Delegation des EP, Hannah Neumann. Das ist Spionage, aber auch der Versuch, einzuschüchtern. #apt42
zeit.de/2025/17/hannah-neumann

2024-10-09

New APT insight from Proofpoint ⬇️

This week, our team observed IRGC/Iraninan-aligned threat group #TA453 continue their phishing efforts despite the recent unsealing of indictments and sanctions by the U.S. government.

Specifically, Proofpoint observed TA453 masquerade as the Centre for Feminist Foreign Policy (CFFP) to target individuals associated with U.S. based universities, media companies, and politically adjacent social benefit organizations.

Today #CISA and the @FBI released a resource guide titled, “How to Protect Against Iranian Targeting of Accounts Associated with National Political Organizations.” It sets a good baseline on ways to protect against a variety of threat actors, including TA453. cisa.gov/resources-tools/resou

TA453 overlaps with reporting on #CharmingKitten, #MintSandstorm, #CharmingCypress and #APT42.

See our recent blog post to learn more about TA453’s malware evolution. ow.ly/OrXE50THoKZ

2024-09-09

ファイブ・アイズ情報長官が警告する「中国ハッカーの脅威」に並ぶ、 #イラン 組織の危険度とは ?
Yahoo!ニュース
企業や組織が #サイバー攻撃 対策として行うべき対応は ? #APT42 は、 #マルウェア を使った攻撃や、 #フィッシングページ などにアクセスさせるといった手法を駆使し、 ...
goo.gl/alerts/a6SPPm

2024-08-23

The Iran-aligned threat actor who compromised the Trump campaign's email systems is known in the cybersecurity research community as #TA453, #APT42, or #CharmingKitten.

"The group's appearance in the U.S. election is noteworthy, sources told @Reuters, because of their invasive #espionage approach against high-value targets in Washington and Israel."

Read the article for insights from Joshua Miller of Proofpoint and other experts: reuters.com/world/trump-campai

Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:youranonriots@kolektiva.social
2024-08-18
2024-08-15

A Single #Iranian #Hacker Group Targeted Both Presidential Campaigns, #Google Says

#APT42 , which is believed to work for Iran’s #RevolutionaryGuard Corps, targeted about a dozen people associated with both Trump’s and Biden’s campaigns this spring, according to Google’s #ThreatAnalysisGroup.
#iran #trump #biden #election #election2024

wired.com/story/iran-apt42-tru

Trending Tech Nieuwstechnieuws@infosec.exchange
2024-08-14

Iranese hackergroep richt zich op beide presidentiële campagnes, volgens google trendingtech.news/trending-new #APT42 #Iranese hackergroep #cyberveiligheid politieke campagnes #Google Threat Analysis Group #hack-en-lek operatie #Trending #News #Nieuws

2024-08-14
Kat Traxler :unverified: :donor:nightmareJS@infosec.exchange
2024-05-29
Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:youranonriots@kolektiva.social
2024-05-08

🚨 ALERT: Iranian hackers (#APT42) posing as journalists and event organizers to launch cyber attacks on NGOs, media, academia, and activists.

thehackernews.com/2024/05/apt4

#cybersecurity #hacking

2022-12-14
Abir Ghattas :verified:abirghattas@infosec.exchange
2022-12-05

#HRW and #Amnesty investigation reveals #Iran gov't backed hackers have targeted activists, journalists, & researchers working on Middle East issues with phishing attacks.

@humanrightswatch infosec team attributes this campaign to state-backed threat actor #APT42.

I spent the past couple of weeks with @tek and @donncha investigating an ongoing social engineering and phishing campaign that impersonated a think tank based in #Lebanon to trick its targets and invite them to a summit.

2 HRW staff were targeted, and after investigating the infrastructure used, we found 18 other targets. at least 3 targets were successfully compromised by #APT42

Read the full report and the technical analysis on HRW's website 👇

hrw.org/news/2022/12/05/iran-s

Julian-Ferdinand Vögelejulianferdinand@infosec.exchange
2022-11-30

Recorded Future published a report on a #phishing and follow-on credential theft attack highly likely led by an #Iran nexus threat activity group targeted against the US-based Washington Institute think tank. While we track this group under the temporary designator TAG56, it depicts many of the known TTPs associated with #APT42 and has overlaps in victimology: recordedfuture.com/suspected-i

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst