Iranian Hackers Launch ‘SpearSpecter’ Spy Operation on Defense & Government Targets

The Hacker News reports that the Iranian state-sponsored threat actor APT42 has been observed targeting individuals and organisations of interest to the IRGC in a new espionage-focused campaign codenamed SpearSpecter, detected in early September 2025 and described as ongoing.

According to INDA, SpearSpecter targets high-value defence and government officials using personalised social engineering, including invitations to conferences or meetings, and extends to the targets’ family members to widen the attack surface. INDA researchers describe the operation as a sophisticated blend of agility, stealth, and operational security that combines legitimate cloud services with attacker-controlled resources to enable initial access, persistent C2, and covert data exfiltration.

The campaign employs several techniques, such as impersonating trusted WhatsApp contacts to deliver a malicious link that redirects to a WebDAV-hosted LNK masquerading as a PDF file, which retrieves a batch script from a Cloudflare Workers subdomain to loader TAMECAT, a PowerShell backdoor used for data exfiltration and remote control. TAMECAT uses HTTPS, Discord, and Telegram for C2, with Telegram-based commands guiding infected hosts and Discord used for coordination.