Actors/Nation-state / APT/Asia

APT42

APTIR · Iran

AKA UNC788 · CALANQUE · ITG18 · Yellow Garuda · Damselfly

CrowdStrike: Charming KittenMicrosoft: Mint SandstormProofpoint: TA453

Targets21

Sectors15

Threat types1

GIRs covered0/480

Active since2015

Victimology

Geographic footprint · 21 countries

origin · Irantargeted countries · 21

ASIA · 9

United Arab Emirates · Azerbaijan · Israel · Iraq · Iran · Lebanon · Malaysia · Saudi Arabia · Türkiye

EUROPE · 9

Albania · Austria · Belgium · Bulgaria · Germany · United Kingdom · Italy · Norway · Ukraine

OCEANIA · 1

Australia

AFRICA · 1

Egypt

AMERICAS · 1

United States

Sectors targeted

15 of 40

Government83 actors Defense60 actors Aerospace49 actors Financial Services61 actors Healthcare38 actors Pharmaceutical24 actors Technology51 actors NGOs & Dissidents47 actors Energy / Utilities49 actors Oil and Gas19 actors Education & Research50 actors Manufacturing (man)40 actors Media & Journalism41 actors Legal & Professional13 actors Dissidents (as targets)14 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 20 techniques

Reconnaissance · 1

T1682Query Public AI Services

Resource Development · 1

T1583.003Virtual Private Server

Initial Access · 1

Execution · 4

T1047Windows Management Instrumentation

Persistence · 1

T1547Boot or Logon Autostart Execution

Credential Access · 2

T1111Multi-Factor Authentication Interception

Discovery · 1

T1016System Network Configuration Discovery

Collection · 2

T1056Input Capture T1113Screen Capture

Command And Control · 3

T1071.001Web Protocols T1102Web Service

Defense Impairment · 1

T1112Modify Registry

Stealth · 3

T1036.005Match Legitimate Resource Name or Location T1070Indicator Removal

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1566.002

Spearphishing Link

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.005Visual Basic

T1555.003

Credentials from Web Browsers

T1573.002

Asymmetric Cryptography

T1684.001

Impersonation