Iranian Hackers Target Defense and Government Officials in Ongoing Campaign

The Iranian state‑sponsored hacking group APT42, also known as SpearSpecter, is reportedly conducting an ongoing, sophisticated espionage campaign targeting senior defence and government officials, according to INDA, the Israel National Digital Agency. The operation has expanded to press targets by manipulating the victims’ family members and using social engineering to lure them to spoofed pages or decoy documents for credential harvesting and long‑term access.

INDA notes that the campaign uses a modular PowerShell backdoor named TameCat, with C&C channels over Telegram and Discord, designed to sustain persistence, conduct reconnaissance and exfiltrate data, including browser information and documents. TameCat operates as an in‑memory loader, uses signed Windows binaries, and employs obfuscation and in‑memory encryption to evade detection, while dynamically loading additional payloads.

The operators build multi‑day conversations to appear credible and even use WhatsApp to enhance legitimacy, reflecting a blend of agility, stealth, and operational security in their sustained espionage against high‑value targets. Written by Ionut Arghire, the report was published on 17 November 2025.