APT42: Iran's Human-Centric Espionage in 2026

Post 3 of 5. How an IRGC-subordinated espionage group spends weeks building trust on and WhatsApp before it sends a single malicious link, and why its most effective intrusions increasingly leave no malware on an endpoint at all.

KELA’s Cyber Intelligence Center (CIC) is a dedicated team of expert threat intelligence analysts who conduct deep investigations and analysis to support clients with customized, actionable intelligence. The CIC empowers KELA customers with high-value insights derived from dark web monitoring, cybercriminal communities, and exclusive intelligence sources.

Lewis Henderson is a cyber security veteran with over 26 years of experience protecting Government, CNI, and heavily regulated sectors such as Banking & Finance. A specialist in External Cyber Threat Intelligence, Exposure Management and Third Party Digital Risks, Lewis focuses on enabling organizations achieve operational maturity. By bridging the gap between technical telemetry and executive strategy, he empowers security teams to evolve from reactive responders into proactive, intelligence-driven defenders from nation-state and criminal cyber threats.

Published July 22, 2026

In an ongoing operation that public reporting tracks as SpearSpecter, APT42 operators identify a senior defense or government official, research them in depth, and then make with an invitation — to a prestigious conference, or to a strategic meeting. There is no payload in the first message, or the second, or often the tenth. Operators communicate for days or weeks over WhatsApp, building a relationship, before any malware is delivered.

If you read Post 2 of this series, you'll recognize the contrast immediately. MuddyWater is a volume actor that runs large phishing campaigns and blends into network traffic with legitimate tooling. APT42 is the opposite end of the Iranian spectrum: patient, personnel-driven, and increasingly able to compromise a target's cloud accounts without ever touching their endpoint.

This post explains how APT42 operates, why its tradecraft defeats the controls most enterprises lean on, and why a think-tank-and-journalists threat model already has named US victims.

» Strengthen your cybersecurity with KELA

Unlike financially motivated actors, it pursues political, military, and intelligence objectives tied to Iranian state interests — long-term surveillance of adversaries, monitoring of targets, and suppression of perceived threats to the regime.

Its targeting is unusually specific.

APT42 systematically goes after government ministries, diplomatic missions, think-tanks, NGOs, academia, media, telecommunications, aerospace, and defense organizations. The individual is the real objective, and the organization is frequently just the vector.

Primary victims include foreign policymakers, senior defense and government officials, journalists covering the Middle East, researchers, and Iranian dissidents abroad.

In some cases the group widens its reach by targeting the family members of primary targets. Documented activity spans the Middle East, North America, Europe (with specific notes in Germany and the UK), and Central Asia.

» Understand how threat actors breach and exploit your data

For a Global 1000 security leader, the business impact is not data destruction or ransom. It is the quiet, prolonged compromise of executive identities, board-adjacent advisors, regional staff, and the cloud accounts they rely on.

APT42's shift toward malware-free cloud access means an intrusion can persist for months inside Microsoft 365 or Google Workspace with nothing for an endpoint product to detect. Any organization employing people in Middle East-related roles—including policy, journalism, defense, or regional leadership—carries exposure that traditional sector- and geography-based threat models will miss.

Here is the updated content, fully converted to US English (using "z" and standardized spelling) with improved, consistent H2 and H3 heading structures for readability.

APT42's defining characteristic is strategic patience, and its history reads as a series of adaptations to whatever Iran's intelligence priorities were at the time.

From its earliest documented activity, the group concentrated on Western think-tanks and academics researching Middle East policy, gathering intelligence on foreign diplomacy. This is the origin of the personnel-first targeting model that still defines it.

Exploiting global anxiety, APT42 leaned on COVID-19 themes to target healthcare, pharmaceutical research, and liberal-arts institutions — an opportunistic pivot that kept the same social-engineering core but swapped the pretext.

The group escalated its harassment of journalists and dissidents through heavy use of Android malware for personal surveillance — GPS, messages, contacts. During this period, it also conducted joint operations with other Iranian units, including MuddyWater and OilRig, making heavy use of RMM software against Israeli and Central Asian targets. The geopolitical framing is consistent throughout: lures tracked Iran's domestic unrest, economic pressure, and escalations in the Iran-Israel conflict, all chosen to compromise regional subject-matter experts.

That arc matters because it shows the constant. The pretext changes with the headlines; the method — find a specific high-value person, earn their trust, then exploit it — does not.

The current flagship operation. Targets are senior defense and government officials, selected through deep reconnaissance and approached with conference invitations or strategic-meeting offers, followed by days-to-weeks of WhatsApp rapport before any malware is introduced.

The dwell time before compromise is itself the tradecraft: by the time a link arrives, the target has been conditioned to expect it.

A cluster that is not definitively attributed to APT42 but that researchers assess as overlapping or linked. It used carefully spoofed emails impersonating prominent foreign-policy experts — among them Suzanne Maloney and Patrick Clawson — to target US-based academics and think-tank personnel researching Iranian societal reform and IRGC militarization. This is the clearest recent signal that the think-tank threat model is a US threat model.

A fraudulent website mimicking a legitimate Hamburg-based model agency, hosting obfuscated JavaScript to fingerprint visitors and featuring a fictitious model profile ("Shir Benzion") with a private-album lure — aimed at Iranian dissidents and activists in Germany.

APT42's tradecraft sits in five tactical buckets. Full ATT&CK mapping and runnable hunt queries are in the appendix and the companion repository linked at the close of this post ([CIC repo]).

Spear-phishing is the primary vector ( T1566.002 ), but the defining feature is the rapport-building that precedes it. Operators cultivate relationships over , WhatsApp, and email, frequently posing as journalists, think-tank members, or recruiters. Only once trust is established do they deliver malicious links disguised as meeting documents, OnlyOffice collaboration URLs, or job applications ( T1204.001 ). The group also abuses the Windows -ms URI protocol handler alongside WebDAV servers to silently stage malicious .LNK shortcut files that appear to the victim as PDFs ( T1204.002 ) — a technique that turns a single click on a "document" into remote payload retrieval.

» Want to understand how attackers weaponize legitimate remote access tools? Read our guide to the Initial Access Broker's Toolbox

The principal implant is TAMECAT, a modular, PowerShell-based backdoor that runs almost entirely in memory (T1059.001, T1620). It pulls payloads dynamically and supports multi-channel C2 over Telegram, Discord, and HTTPS. For mobile targets, the group deploys custom Android malware that tracks GPS location, messages, and contacts — surveillance tooling aimed squarely at the individual rather than the enterprise network.

This is where APT42's precision shows. To pull browser data without tripping file locks, TAMECAT exploits Microsoft Edge's remote debugging port (9222) in hidden mode to extract decrypted cookies, and uses the Sysinternals tool PsSuspend to freeze Chrome and safely copy locked SQLite databases ( T1555.003 , T1539 ). It spawns fraudulent system prompts via the CredUIPromptForWindowsCredentials function to harvest Outlook or Windows passwords ( T1056.002 ), and the broader campaign set includes multi-factor-authentication interception ( T1111 ). High-value data such as Outlook PST files is split into 1MB–5MB chunks using tools like Runs.dll or WinRAR to blend exfiltration into normal web traffic ( T1030 ).

» Learn how leaked credentials differ from compromised accounts

This is the bucket that should reshape your threat model. APT42 maintains access to Google Workspace and Microsoft 365 without endpoint malware by abusing OAuth application consents ( T1528 ), manipulating mailbox forwarding rules ( T1114.003 ), and generating persistent cloud API keys. C2 is proxied through Azure cloud services and Cloudflare Workers ( *.workers.dev ) so that malicious traffic reads as legitimate enterprise communication ( T1102 , T1071.001 ). Where on-disk persistence is needed, the group leans on legitimate RMM software such as PDQConnect ( T1219 ) or modifies Windows Registry Run keys ( T1547.001 ) — one observed key named, with some irony, "Renovation."

The multi-channel design, Telegram, Discord, HTTPS, all fronted by reputable cloud providers — is built specifically to defeat IOC- and domain-reputation-based detection. There are no suspicious domains to block when the C2 endpoint is a workers.dev subdomain. Exfiltration runs over the same trusted channels ( T1041 ), chunked to stay under traffic-anomaly thresholds.

The throughline across all five buckets: APT42 has engineered its way out of the artifacts most enterprises detect on. Fileless execution removes the disk artifact. Cloud-consent abuse removes the endpoint entirely. Reputable-provider C2 removes the network IOC. What remains is behavior and identity — which is exactly where detection has to move.

» Make sure you understand the most targeted entry points by attackers

Geographically, documented activity spans the Middle East, North America, Europe — with specific notes in Germany and the UK — and Central Asia.

That population includes people who do not look like classic APT targets: a policy researcher on a corporate advisory board, a journalist on staff, a regional executive, a recently hired academic. Each is a doorway, and APT42 is patient enough to use it.

The single most important shift APT42 forces is the recognition that a serious intrusion can run entirely in your cloud tenant. OAuth application-consent abuse, malicious mailbox-forwarding rules, and persistent cloud API keys produce no endpoint malware for EDR to find.

The defensive priorities follow directly:

APT42's multi-week rapport-building is designed to defeat the assumption behind most phishing defenses—that a malicious message arrives cold from a stranger. By the time the link lands, the relationship feels real and the email gateway has nothing to flag.

The actionable question is: "Who in our organization has a Middle East-relevant public profile?"

That includes people working in:

The answer should drive targeted hardening, executive-protection-grade awareness, and, where appropriate, extending that posture to family members and personal devices, which the group has shown it will use as a vector.

Don't wait for your own incident to model the threat.

The UNK_SmudgedSerpent cluster's impersonation of named foreign policy experts to target U.S. academics and think-tank staff is not a hypothetical; it is the documented present. Whether or not that specific cluster is APT42 in the final attribution, the targeting pattern is squarely within the group's playbook and squarely aimed at U.S. soil.

Any organization that employs, funds, or convenes Middle East expertise should assume it is in scope and build identity-aware, person-centric defenses before the first conference invitation arrives.

» Reasons you need cyber threat intelligence

in the series, Prince of Persia (Infy), the decade-old surveillance actor whose tooling now reaches victims across more than twenty countries, and whose C2 went dark on the exact day Iran's January 2026 internet blackout began.

KELA's Cyber Intelligence Center provides finished intelligence and threat-actor monitoring for Global 1000 and Government security teams as part of our platform offering.

For tailored solution introduction and and briefings on the Iranian threat picture in your sector or geography, our team of experts at [email protected] or for KELA customers reach out to your Customer Success Representative.