APT42 was split from the broader APT35/Charming Kitten cluster by Mandiant in 2022 because their operational mandate is fundamentally different. APT35 conducts political espionage against organizations. APT42 conducts surveillance of specific human beings. The IRGC-IO's mission includes monitoring and preventing threats to the Islamic Republic from dissidents, opposition groups, and foreign influence. APT42 is the cyber arm of that surveillance apparatus.

Targeting is personal. APT42 targets individuals by name: Iranian diaspora members, dual-national citizens, human rights activists, journalists covering Iranian affairs, former government officials who left the regime, and academics researching Iranian policy. The intelligence objective is not "what does this organization know" but "what is this person saying, who are they talking to, and where are they."

Surveillance tools, not espionage tools. APT42's custom malware includes Android spyware (PINEFLOWER, VINETHORN) that records calls, captures SMS, tracks GPS location, activates the microphone, and exfiltrates photos and contacts. Their desktop tools (NICECURL, TAMECAT, CHAIRSMACK) focus on keylogging, screen capture, email harvesting, and browser credential theft. These are surveillance capabilities designed to build a comprehensive picture of a target's life, not to pivot through a corporate network.

1. 1. Identify whether individuals in your organization are APT42 target profiles APT42 targets specific categories of people. If your organization employs or protects: Iranian-born or dual-national individuals, journalists covering Middle Eastern affairs, academics researching Iranian policy, human rights workers, or former government officials with Iran expertise, they may be individually targeted regardless of your organization's sector.
2. 2. Check for sustained social engineering correspondence APT42 operators impersonate journalists, think tank researchers, and conference organizers. Check for multi-message email threads from external freemail addresses (Gmail, ProtonMail, Outlook) claiming media or academic affiliations. Verify the sender's identity against the claimed organization's real staff. APT42 personas have fake LinkedIn profiles, fabricated publication histories, and stolen headshots. Email gateway: multi-message thread analysis from freemail to target individuals
3. 3. Hunt for mobile spyware indicators If APT42 is targeting individuals in your organization, check their mobile devices for: sideloaded Android APKs from non-Play Store sources, apps requesting excessive permissions (microphone, camera, SMS, location, contacts simultaneously), persistent VPN connections to unknown endpoints, and unusual battery drain or data usage patterns consistent with continuous background monitoring. MDM: app inventory audit · Android: adb shell pm list packages for unknown packages
4. 4. Check for cloud-abusing C2 from desktop endpoints Search for: PowerShell, VBScript (wscript.exe, cscript.exe), or rundll32 processes making sustained HTTPS connections to Cloudflare Workers subdomains, Firebase APIs, or OneDrive/Google Drive APIs. Legitimate cloud usage comes from browsers and official apps, not from script interpreters. Cross-reference Sysmon EID 1 (process) with EID 3 (network) for script-to-cloud connections. Sysmon EID 1 + EID 3 · Proxy logs: script interpreter user-agents to cloud APIs
5. 5. Check for credential harvesting page visits APT42 builds fake login pages mimicking Google, Microsoft, Yahoo, and academic SSO portals. Search proxy logs for visits to recently registered domains with login-related keywords. The credential harvesting page captures both the password and the session token (AiTM), defeating MFA. Compromised Credentials playbook · Proxy logs · Domain registration monitoring
6. 6. Audit personal cloud accounts of targeted individuals With consent: check the individual's personal Gmail, Outlook, or Yahoo account for unauthorized access (login history from unknown IPs), forwarding rules to unknown addresses, OAuth app consents they didn't authorize, and recently accessed documents. APT42's primary intelligence product is the target's personal communications, not corporate data.

The target is a person, not a network. Every other playbook in this collection treats the organization as the target. APT42 targets the individual. The organization is incidental: they'll compromise a university's network to reach a professor, or an NGO's email to monitor an activist. The network compromise is a means, not an end.

Mobile surveillance at scale. APT42 is one of the few APTs with documented custom Android spyware deployed against named individuals. PINEFLOWER and VINETHORN turn a target's phone into a real-time surveillance device. This capability exists on the same spectrum as NSO Group's Pegasus, but operated by a state intelligence service directly.

The human cost. APT42's targets are not corporations or governments. They are individuals who are often already at personal risk from the Iranian regime. Successful surveillance can lead to arrest of family members still in Iran, intimidation campaigns, and physical harm. The stakes of detecting APT42 are not financial. They are about human safety.

APT35 / Charming Kitten (organizational espionage counterpart, shared infrastructure)
MuddyWater (MOIS, different agency and mandate)
Compromised Credentials (credential theft is APT42's primary access method)
Insider Threat (APT42 surveillance mimics insider monitoring patterns)