Actors/Nation-state / APT/Asia

APT42

G1044APTIR · Iran

AKA UNC788 · CALANQUE · ITG18 · Yellow Garuda · Damselfly · Ballistic Bobcat · Phosphorus · Newscaster · APT35

Secureworks: IRON RITUALMITRE: G1044Microsoft: Mint SandstormProofpoint: TA453CrowdStrike: Charming Kitten

Targets21

Sectors15

Threat types1

GIRs covered0/480

Active since2015

Also tracked as

6 vendor names · 9 other aliases

Open Rosetta Stone

CrowdStrike

Charming Kitten

Mandiant

APT42

Microsoft

Mint Sandstorm

MITRE

G1044

Proofpoint

TA453

Secureworks

IRON RITUAL

UNATTRIBUTED ALIASESUNC788CALANQUEITG18Yellow GarudaDamselflyBallistic BobcatPhosphorusNewscasterAPT35

Victimology

Geographic footprint · 21 countries

origin · Irantargeted countries · 21

ASIA · 9

United Arab Emirates · Azerbaijan · Israel · Iraq · Iran · Lebanon · Malaysia · Saudi Arabia · Türkiye

EUROPE · 9

Albania · Austria · Belgium · Bulgaria · Germany · United Kingdom · Italy · Norway · Ukraine

OCEANIA · 1

Australia

AFRICA · 1

Egypt

AMERICAS · 1

United States

Sectors targeted

15 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Legal & Professional18 actors Dissidents (as targets)16 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 20 techniques

Reconnaissance · 1

T1682Query Public AI Services

Resource Development · 1

T1583.003Virtual Private Server

Initial Access · 1

Execution · 4

T1047Windows Management Instrumentation

Persistence · 1

T1547Boot or Logon Autostart Execution

Credential Access · 2

T1111Multi-Factor Authentication Interception

Discovery · 1

T1016System Network Configuration Discovery

Collection · 2

T1056Input Capture T1113Screen Capture

Command And Control · 3

T1071.001Web Protocols T1102Web Service

Defense Impairment · 1

T1112Modify Registry

Stealth · 3

T1036.005Match Legitimate Resource Name or Location T1070Indicator Removal

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer20 techniques · layer format 4.5

Related actors

By origin and actor type

T1566.002

Spearphishing Link

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.005Visual Basic

T1555.003

Credentials from Web Browsers

T1573.002

Asymmetric Cryptography

T1684.001

Impersonation