DarkAtlas threat intelligence report

APT42 continues to refine a familiar operating model, making it harder to detect and easier to scale.

Three developments define the current picture. SpearSpecter combined prolonged WhatsApp engagement, Windows -ms and WebDAV abuse, and a substantially expanded TAMECAT backdoor. APT42 also incorporated generative AI into target research, persona and pretext development, translation, malware engineering, debugging, code generation, and exploitation research. In March 2026, TA453 activity overlapping APT42 targeted a US think tank with a live credential-phishing operation during an active regional conflict.

Recent malware samples add a technical view. A 2026-dated PDF-themed shortcut, a batch controller, and an obfuscated PowerShell collection module form a probable TAMECAT-compatible chain. A fourth macro workbook carries 2021 timestamps and provides an older point of comparison.

The most important defensive conclusion is not that APT42 has acquired a revolutionary implant. It is that the group now combines four difficult-to-separate layers:

this makes brand impersonation, look-alike domain discovery, executive monitoring, credential-exposure monitoring, and contextual IOC enrichment more useful than a hash-only feed. Endpoint, email, and identity telemetry remain essential: external intelligence can identify the infrastructure and pretext, but it cannot by itself show whether a user opened a lure, approved a browser prompt, surrendered a session, or executed TAMECAT.

APT42 is an Iran-linked threat actor associated with targeted phishing, credential theft, espionage, and social-engineering operations against high-value individuals and organizations.

The group is also closely associated with activity tracked as TA453 in some reporting. Its operations often rely on believable personas, trusted communication channels, and carefully staged phishing flows rather than high-volume spam.

In this report, APT42 is used as the primary actor name, TA453 is used where the activity is tracked under that label, and SpearSpecter refers to the specific campaign discussed below.

Threat actor names often overlap across public reporting. For that reason, this analysis uses clear attribution boundaries.

An alias match alone does not prove that every operation reported under another “Kitten” name belongs to the same team.

This distinction matters because Iran-nexus activity is broad. For example, January 2026 RedKitten activity may be relevant to regional monitoring, but it should not be presented as a confirmed APT42 campaign unless supported by reliable attribution.

SpearSpecter targeted senior defense and government figures and, in some cases, their family members. This was not mass phishing. Operators conducted reconnaissance, impersonated credible contacts, and built trust over days or weeks, including through WhatsApp.

Depending on the objective, victims were directed either to a credential-harvesting flow or to a TAMECAT infection chain.

The malware-delivery path creates several behavioral detection points before the backdoor is fully established:

The key detection opportunity is the full sequence, not one indicator. A high-confidence analytic should correlate browser invocation of -ms , WebDAV access through rundll32.exe , a remote .lnk launching cmd.exe , and curl retrieving content that is passed to PowerShell.

This sequence makes the initial page, file extension, and final process tree more useful together than any one indicator. A broad block on OneDrive, Cloudflare Workers, Discord, or Telegram would be impractical. A higher-confidence analytic is the rare sequence of a browser invoking -ms , rundll32.exe establishing WebDAV access, a remote .lnk launching cmd.exe , and curl retrieving content that is handed to PowerShell.

TAMECAT operates as a modular surveillance and collection framework rather than a simple downloader. Its obsTAMECAT operates as a modular surveillance and collection framework, not just a downloader.

Observed capabilities include:

The browser module is especially important for identity defense. TAMECAT can launch Microsoft Edge off-screen with --no-sandbox and --remote-debugging-port=9222 , then use the DevTools Protocol to request decrypted cookies.

It can also suspend Chrome with Sysinternals PsSuspend to release locks on browser databases before copying or parsing them.

This means a password reset may not be enough after host compromise. Responders should revoke active sessions, invalidate refresh tokens, and investigate browser-stored credentials.

SpearSpecter also represents publicly documented APT42 use of Discord and Telegram for command and control alongside HTTPS.

For defenders, the important signal is not only the use of encrypted traffic. The stronger detection context is workstation PowerShell or MSXML2.serverXMLHTTP reaching messaging APIs, especially after a -ms and WebDAV delivery chain

Recently observed samples provide additional insight into APT42’s malware delivery and post-compromise activity.

The sample set includes:

These samples show how APT42 continues to combine social engineering, legitimate cloud infrastructure, PowerShell execution, and modular collection logic.

The central file in this activity was Document.pdf.lnk , a Windows shortcut disguised as a PDF. The file has SHA-256:

783a55c215ff18ea618f5a63936e08044448901096ee4de2d23fcda740abe104

The shortcut served as a delivery file for a TAMECAT PowerShell toehold and is linked with high confidence to an APT42 campaign likely targeting people associated with the nuclear-energy sector.

The social-engineering theme used podcast and interview invitations, continuing the group’s preference for credible professional engagement before malware delivery.

The shortcut was hosted at three observed locations:

An open directory on synctimenow[.]org contained timestamp and campaign-code artifacts indicating deployment on or before 25 April. The exact LNK was later submitted to VirusTotal on 16 and 18 May from Sweden, the United Kingdom, and Ukraine. Submission geography describes where copies reached the repository and does not identify the targets or operators.

When executed, the LNK sends n=88_&T=bgeuYESS to personal-store[.]netlify[.]app/yo3u , saves the response as a batch file, and uses the session key bgeu across later PowerShell communication. The batch stage opens a benign OneDrive document as a decoy while establishing with projects-shared[.]netlify[.]app . The confirmed batch retrieved in this chain has SHA-256 5c38af2f39802c0362a72247bfd52a35e16b93f45dfe1a2b573a2e620c8d1189 .

Public web-scan records contain ten submissions for personal-store[.]netlify[.]app between 16 and 27 May. Eight used the exact /yo3u path embedded in the LNK. Initial scans returned HTTP 405, which is compatible with a browser GET request reaching an endpoint designed for the LNK’s POST request. By 21 May, later scans returned HTTP 404 with the Netlify title Site not found .

This TAMECAT variant added resilience beyond the two Netlify services. One persistence component generated candidate domains from a hard-coded seed, with synctimenow[.]org observed active.

Another component retrieved Telegram bot configuration, although active Telegram C2 was not observed during analysis.

The combination gave the operators multiple recovery paths if a cloud-hosted endpoint was removed.

The recent sample set provides complementary views of APT42 delivery and post-compromise activity. The confirmed TAMECAT shortcut records the late-April execution path, two closely aligned variants expose controller and collection logic, and a macro-enabled workbook illustrates a separate Office-based route.

A 1,196-byte shortcut was staged as Document.pdf.lnk , while its internal description is honorium-form.pdf and its icon points to Microsoft Edge. It targets C:\Windows\System32\cmd.exe , but these presentation properties are intended to make it look like a document rather than a command launcher. Its command line uses set "b=url" and c%b% to reconstruct the word curl only when cmd.exe interprets it.

The reconstructed behavior is:

This behavior is now confirmed as part of an APT42 TAMECAT delivery chain. The exact LNK hash, bgeuYESS tracking value, bgeu session key, /yo3u endpoint, and external staging locations were documented together in the late-April campaign. The similarity to SpearSpecter reflects continued reuse and iteration of TAMECAT delivery methods rather than attribution based only on behavioral resemblance.

The analyzed sample closely aligns controller variant with the same campaign key, C2 service, identifier structure, OneDrive decoy behavior, and temporary PowerShell tasking pattern. It immediately alters host state if executed, piping into clip , deleting the current user’s RunMRU registry history, and launching PowerShell under conhost.exe --headless . Static review identified the following controller logic:

The combination of headless conhost , PowerShell, cmd , Edge, a benign OneDrive decoy, Base64 tasking, and temporary PowerShell modules is highly consistent with the wider TAMECAT activity. It also creates more durable hunt opportunities than the Netlify hostname alone.

The documented campaign used additional persistence logic to request a batch stage from projects-shared[.]netlify[.]app/Top4d with the form values RNE2=random&INE2= . That stage generated domains from a hard-coded seed, allowing TAMECAT to recover if its primary Netlify infrastructure was removed. A separate persistence component retrieved Telegram configuration, but no active Telegram command-and-control traffic was observed during analysis.

This sample is a variant of the same PersistenceMonitor capability documented in a confirmed campaign. The 4,108-byte PowerShell file begins with a monoalphabetic substitution table, reconstructs a second script one character at a time, and passes the result to IEX . For safety, the substitution was reversed as text and the resulting script was not invoked.

The decoded module identifies itself as PersistenceMonitor and uses the same projects-shared[.]netlify[.]app host as the batch controller, with the path / . It reads the registered owner and system drive, then inventories both of these per-user persistence locations:

Results are written to %TEMP%\PersistenceMonitor.txt , Base64-encoded, split into chunks of up to 1,000,000 characters, labeled as First , Middle , End , or Overflow , and sent through an HTTP form field named Data . The temporary text file is deleted after transmission.

This is a collection and exfiltration module, not a persistence installer. Its likely purpose is to tell the operator what survives logon and which software has already registered autostart entries. That information can support follow-on tasking, conflict avoidance, or security-product discovery. The sample also contains a hard-coded victim label, Bruno_DESKTOPET51AJO , which suggests the module may have been generated or configured for a specific host.

Late-April TAMECAT chain contained a broader set of task-specific modules:

Most collection modules write results to named files, Base64-encode the content, divide it into chunks, and upload it through projects-shared[.]netlify[.]app/ . Each module uses a substitution map for obfuscation, creating a reusable family-level detection opportunity even when hashes change.

An 53,118-byte OOXML archive contains xl/vbaProject.bin , a hidden worksheet, an embedded Paint bitmap, and two scripts stored as shared worksheet strings. The visible sheet displays an Office compatibility error and instructs the user to select Enable Editing and Enable Content . The embedded OLE object resolves to Paint.Picture.1 and contains bitmap data, not an executable payload.

The Workbook_Open macro runs automatically when macros are enabled. It uses URLDownloadToFileA , retrieves the username, and writes several files under %APPDATA% , including:

The macro presents a prompt asking whether to enable content, but both Yes and No branches write payload material and download content. The Yes branch additionally reveals the hidden sheet. One worksheet script stores a UTF-16LE Base64 PowerShell controller in HKCU\Software\Classes\Key and creates a RunOnce value named systemUpdating to decode it.

The decoded controller contacts 1thebstack1[.]xyz/Api/Session every three seconds. It identifies itself as PowerWindows , reads the token from %APPDATA%\Ni.txt , and accepts Base64 tasking for arbitrary PowerShell and in-memory C# execution. Its use of wildcard command resolution, inserted junk text in powershell , registry-stored Base64, and a hidden worksheet are all static obfuscation and persistence signals.

The strongest conclusion is no longer based only on behavioral similarity. The exact LNK and its infrastructure are attributed to APT42 with high confidence, and the chain is assessed as a TAMECAT campaign likely targeting the nuclear-energy sector.

The locally analyzed batch and PersistenceMonitor files should be treated as variant-level matches because their hashes differ from the confirmed downstream files. This distinction keeps the attribution strong without claiming that all local files came from one live execution.

APT42 appears to use generative AI as an operational accelerator, not as a fully autonomous intrusion system.

Observed uses include:

Language quality is now a weak phishing indicator.

APT42 already relied on rapport-building, multi-message engagement, and believable social engineering. Generative AI makes it easier to sustain a coherent persona across multiple messages, languages, and communication channels.

Organizations should verify the relationship and the request, not only the writing quality.

Useful checks include:

On 8 March 2026, eight days after US and Israeli strikes inside Iran began the conflict, TA453 targeted a US think-tank employee with a credential-phishing operation. The email thread had started in February with a benign invitation sent to the target’s personal account, then expanded to corporate accounts after the conflict began.

This is confirmed targeted activity during the war, but the chronology matters. The approach began before the fighting, so the evidence does not show that the campaign was created in response to the conflict. Instead, it shows that an existing APT42-aligned intelligence operation continued during the war and remained focused on a strategically relevant air-defense theme.

The conflict also appears to have reached physical infrastructure associated with the wider IRGC phishing operation. On 23 March, strike damage was reported on Malekloo Street in eastern Tehran. Open-source imagery identified the damaged building as the Malekloo Office, a location previously connected to IRGC cyber operators Masoud Jalili, Seyyed Ali Aghamiri, and Yaser Balaghi. The office had eight static IP addresses and high-speed external connectivity, supporting phishing operations against US officials, journalists, policy organizations, and political campaigns. The three operators were charged in 2024 over a campaign using forged identities, spoofed login pages, stolen accounts, credential harvesting, and attempts to capture multifactor authentication codes. The same election-related targeting pattern has been independently tracked as APT42.

The attacker used McManus.Michael@hotmail[.]com to impersonate Michael McManus, head of research at the Henry Jackson Society. The pretext was a roundtable on air defense in the Middle East. To make the invitation credible, the sender first provided a benign PDF through a genuine Microsoft OneDrive link. Only after rapport was established did the actor send a malicious link disguised as another event PDF.

credible identity → benign conversation → genuine cloud-hosted document → attacker-controlled redirect → cloud-hosted credential phish

This chain defeats simplistic advice such as “check whether the first link is Microsoft.” It also demonstrates why external brand and domain monitoring should be joined with email and identity telemetry. A newly registered or low-reputation redirector can be detected externally; the pre-filled email, successful credential submission, subsequent sign-in, and session changes require internal visibility.

The genuine 1drv.ms link hosted the benign lure and should not be treated as malicious platform-wide.

APT42’s current tradecraft aligns with four DarkAtlas capability areas. Each capability has a clear role and a clear boundary.

This is also a useful model for prioritizing alerts. A single newly registered domain resembling a customer’s brand may be low confidence. The same domain becomes high priority when it impersonates a monitored executive, appears in a conversation with a high-risk employee, redirects to a cloud-hosted login clone, or is linked to a sample whose behavior matches the TAMECAT chain.

DarkAtlas’s Threat Intelligence offering supports IOC, YARA/Sigma, threat-actor, and manual-malware-analysis workflows. Its Brand Protection capability covers phishing-site, impersonation, executive, and typosquatting monitoring. Attack Surface Management and Dark Web Monitoring provide the complementary exposure view.

APT42 remains an intelligence-collection threat whose advantage comes from patient human targeting, now accelerated by AI and supported by more resilient malware when needed.

The recent TAMECAT activity shows that the group continues to evolve its delivery, persistence, and recovery options. SpearSpecter increased the technical depth of the malware chain, but the actor still depends on the victim accepting a relationship, opening a prompt, clicking a link, or submitting credentials.

That dependency creates defensive opportunities.

The strongest control set is not a static blocklist. It is the correlation of external impersonation and infrastructure intelligence with email history, endpoint process chains, identity events, and cloud telemetry.

DarkAtlas can support the external intelligence and enrichment layers, while customer-side email, EDR, identity, and cloud logs determine whether an attempted approach became a compromise.