APT42 Threat Actor Profile: Cloud Credential Phishing, ATT&CK Mapping and Defences

APT42 rarely needs malware: it talks its way into a target's mailbox, beats the second factor, then reads, exports and hides its tracks with the victim's own Microsoft 365 or Google features. This profile covers the Iranian espionage group that MITRE ATT&CK tracks as G1044. It focuses on what sets APT42 apart from the wider Charming Kitten cluster: patient rapport building, credential phishing with second factor capture, and data theft from cloud mail and storage. It draws on MITRE ATT&CK v20, Mandiant and Google Threat Intelligence reporting, the September 2024 joint advisory from the FBI, US Cyber National Mission Force, US Treasury and the UK NCSC, and follows each source's own attribution wording. It is written for security teams at NGOs, think tanks, universities, law firms, media and government, and for anyone protecting high-risk individuals. For the overlapping cluster as a whole, see the Charming Kitten (APT35) Threat Actor Profile.

Key takeaways

• The account is the target. Mandiant describes three long-running infrastructure clusters built to harvest Google, Microsoft, Yahoo and other logins, with malware used mainly when objectives go further.
• Codes and pushes do not stop it. Sources record fake Duo pages, captured SMS codes, push prompts sent during login and phishing kits built to collect MFA codes, device PINs and recovery codes. Only phishing-resistant authentication breaks the chain.
• Persistence lives in account settings. App passwords, changed recovery addresses, an approved mail client and "Keep Me Signed In" sessions all outlive a password reset unless they are removed too.
• Cloud data theft blends in. In 2022 and 2023 intrusions Mandiant saw APT42 use built-in Microsoft 365 features and public tools, anonymised VPN and VPS infrastructure, and clear browser history after reviewing documents.
• Rapport comes before the link. First emails can be harmless requests for comment, interviews or conference invitations; the malicious link follows days or weeks later, sometimes on a messaging app.

Who they are (names and aliases)

MITRE ATT&CK describes APT42 as an Iranian-sponsored group that conducts cyber espionage and surveillance, focused on the Middle East but targeting many industries and countries since at least 2015. ATT&CK notes that commercial vendors link APT42 to Magic Hound (G0059), but that the two appear to be distinct and are tracked separately by the vendor that named them. Mandiant assesses, with moderate confidence in its 2022 report, that APT42 operates on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). Google's Threat Analysis Group describes APT42 as associated with the IRGC.

Overlap is not identity. Vendors split clusters differently, so a report on "Mint Sandstorm" or "TA453" may describe APT42 activity, APT35 activity or both. The joint government advisory of September 2024 names no vendor cluster: it refers to cyber actors working on behalf of the IRGC. No individuals are named on this page. For the wider ecosystem, see the Iran State Cyber Operations Guide.

Software associated in ATT&CK

Targeting and motivation

• People, not networks: Mandiant lists Western and Middle Eastern NGOs, media, academia, legal services and activists, along with policy and government staff, and individuals Tehran sees as threats such as journalists, women's rights activists and Persian-language media.
• Geography: Google reported that Israel and the US accounted for roughly 60% of APT42's known geographic targeting between February and late July 2024. Mandiant also names the UK, UAE, Azerbaijan and Europe.
• Elections: Google reported that in May and June 2024 APT42 targeted about a dozen people linked to the Biden and Trump campaigns, and that it accessed the personal Gmail account of a high-profile political consultant. The September 2024 joint advisory and an October 2024 CISA and FBI fact sheet describe IRGC-affiliated actors targeting people connected to US political campaigns.
• Shifting priorities: Mandiant observed pharmaceutical targeting at the start of COVID-19 and opposition targeting before an Iranian presidential election, and noted that APT42 stayed with intelligence collection after October 2023 while other Iran-nexus actors turned to disruption and hack-and-leak.
• Motivation: state intelligence collection and surveillance. Sources read for this page do not describe financially motivated activity by APT42.

How an APT42 operation unfolds

Reconnaissance and personas

Google reported APT42 using marketing and social media research tools to find personal email accounts without MFA, and studying account recovery flows to learn each target's second factor. ATT&CK v20 also records Query Public AI Services (T1682): Google's January 2025 report found that over 30% of Iranian government-backed use of Gemini was linked to APT42, mostly for reconnaissance on policy and defence experts, phishing content and translation, with no novel capability observed. Personas impersonate real journalists, researchers and think tanks, using typosquatted domains such as look-alikes of the Washington Post, the Institute for the Study of War and the Brookings Institution.

The three credential harvesting clusters

Second factor bypass

Mandiant documented fake Duo pages to capture codes (one failed attempt), push prompts sent to the victim during the attacker's own login (successful), and a captured SMS code followed by the "Keep Me Signed In" option to avoid re-authentication. Google described the GCollection phishing kit family, in development since January 2023, which supports MFA codes, device PINs and recovery codes, and a simpler browser-in-the-browser kit. Pages were sometimes hosted on Google Sites, or reached through URL shorteners and ngrok redirects, to borrow a trusted domain. See the AiTM Phishing Guide and the MFA Fatigue and Bypass Guide.

Cloud data theft

In 2022 and 2023 intrusions against legal services and NGO victims in the US and UK, Mandiant saw APT42 approve its own Thunderbird client on the account, create a Microsoft app password in at least one case, sign in to a Citrix application and use RDP, run native discovery commands and the open-source PowerHuntShares module to find open shares, stage files in password-protected 7-Zip archives, and take data from OneDrive, Outlook and local documents. It also attempted to move files to an attacker OneDrive account named after the victim organisation. Google reported changed recovery addresses and app-specific passwords on compromised Gmail accounts.

Tactics and techniques (MITRE ATT&CK)

All IDs below are ATT&CK v20 techniques recorded against G1044, except rows marked as NHI Mgmt Group mapping of a vendor description. v20 places masquerading and indicator removal under the Stealth tactic.

How they abuse identities and credentials

• Personal accounts as the soft entry: Google and the joint advisory both stress personal email. A senior official's private Gmail often holds work threads, contacts and recovery paths to work accounts, but sits outside corporate controls. Offer protection for personal accounts of high-risk staff, such as Google's Advanced Protection Program, which Google says revokes app-specific passwords in Gmail.
• App passwords: an app password is a static secret that skips MFA. In Microsoft Entra ID it belongs to legacy per-user MFA, so moving to Conditional Access and disabling app passwords removes the persistence path. See the App Passwords Security Guide and Entra Per-User MFA to Conditional Access.
• Approved mail clients and sessions: a client added to the account, a remembered session or a changed recovery address keeps working after a password change. Response must revoke sessions and refresh tokens and review every authentication method and recovery setting.
• Mailbox rules and forwarding: the joint advisory warns of forwarding rules and recommends prohibiting automatic external forwarding. See How to Audit Mailbox Forwarding and Inbox Rules.
• Look-alike cloud storage accounts: an attacker-owned OneDrive or outlook.com account named after the victim organisation makes exfiltration look internal. Restrict sharing to approved domains and alert on sync to unmanaged tenants.

Notable activity

Detection and defence

What to monitor

For query patterns, see the Entra ID Sign-In and Audit Log Detection Guide and the Microsoft 365 Unified Audit Log Guide for Detection.

Phased response plan

1. Name the high-risk population: list staff whose roles match the targeting (policy, Iran and Middle East specialists, executives, communications, legal), including their personal accounts where they agree to enrol.
2. Move them to phishing-resistant MFA: FIDO2 security keys or passkeys, with a Conditional Access authentication strength that requires them. Pilot with a small group, keep a break-glass account excluded and monitored, and roll back per group if access fails. See the Passkey Rollout Guide.
3. Remove bypass paths: disable app passwords and legacy authentication, block SMS and voice as methods for this group, and require number matching for any remaining push.
4. Close the mailbox: block automatic external forwarding, restrict user consent to applications, and alert on rule changes that delete or move security messages.
5. Prepare the response: a runbook that revokes sessions and refresh tokens, removes app passwords and unknown methods, restores recovery details and reviews mail rules and OneDrive sharing. See the Account Takeover Response Playbook.
6. Train for the slow approach: brief targets that interview, conference and petition requests are the lure, and that a request to move to Signal, WhatsApp or a video call is a common next step.

Decision guidance

• Security keys or passkeys: hardware keys suit people who travel and are targeted by name; synced passkeys suit wider rollouts. Both defeat the code and push capture documented here.
• Small NGOs and think tanks: the highest-value steps cost little: phishing-resistant MFA on the main mail platform, Google Advanced Protection for personal accounts and a rule that no one logs in from a link in a message they did not expect. The NCSC offers free services for high-risk individuals in the UK.
• Large organisations: add detection on sign-in risk, app password and method changes, and bulk cloud downloads, and a protective programme for executives' personal accounts.

Metrics

• Percentage of identified high-risk users with phishing-resistant MFA enforced (target 100%).
• Number of accounts with active app passwords or SMS as a method (target zero in the high-risk group).
• Number of mailboxes with external auto-forwarding (target zero unless approved).
• Median time from a reported suspicious approach to account review.
• Percentage of high-risk staff who reported a test approach in the last exercise.

Framework mapping

Common failure patterns

• Resetting the password only: app passwords, approved clients, remembered sessions and changed recovery addresses keep the attacker in.
• Exempting VIPs from strong MFA: the people APT42 wants most are often the ones allowed SMS or push for convenience.
• Ignoring personal accounts: the organisation's tenant is hardened while the target's private Gmail, holding the same conversations, is not.
• Trusting a known domain: pages on Google Sites, Dropbox or a URL shortener pass reputation checks; the domain is legitimate even when the page is not.
• Security alerts that the attacker can delete: login notifications sent only to the compromised mailbox are removed before the user sees them.

Practitioner checklist

• Identify high-risk roles and offer protection for their personal accounts.
• Enforce FIDO2 keys or passkeys for that group through an authentication strength policy.
• Disable app passwords, legacy authentication and SMS or voice methods for that group.
• Alert on new authentication methods, recovery changes and app password creation.
• Block automatic external forwarding and alert on rules that delete security messages.
• Restrict user consent to applications and review approved mail clients.
• Alert on bulk OneDrive, SharePoint and Drive downloads and syncs to outside accounts.
• Block LNK and script attachments and log PowerShell on endpoints of high-risk staff.
• Keep an account takeover runbook that revokes sessions and every persistence setting.

Standards and references

• MITRE ATT&CK: APT42 (G1044)
• Mandiant (Google Cloud): Uncharmed, Untangling Iran's APT42 Operations
• Mandiant (Google Cloud): APT42, Crooked Charms, Cons and Compromises
• Google Threat Analysis Group: Iranian-backed group steps up phishing campaigns against Israel, US
• FBI, CNMF, US Treasury and UK NCSC: Iranian Cyber Actors Targeting Personal Accounts to Support Operations
• UK NCSC: UK and US issue alert on cyber actors working on behalf of the Iranian state
• Google Threat Intelligence Group: Adversarial Misuse of Generative AI
• Microsoft: How Microsoft names threat actors

Related NHI Mgmt Group resources: Charming Kitten (APT35) Threat Actor Profile · Iran State Cyber Operations Guide · MITRE ATT&CK T1111 Multi-Factor Authentication Interception · Mobile Communications Protection for High-Risk Individuals Guide · Nimbus Manticore (UNC1549) Threat Actor Profile