threat actor · Iran
APT42
33 techniques · 2 software
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open APT42's actor pageAPT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, APT42 exfiltrates data using native features and open-source tools.
Read the rest
APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
Source: MITRE ATT&CK, G1044. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
- Also known as
- UNC788, CALANQUE, CALANQUE ION
- Origin
- Iran
- Suspected sponsor
- Iran (Islamic Republic of)
- Motivation
- espionage
- Kind
- state
- MITRE ATT&CK
- G1044
- On record in
- CyberSIXT · ATT&CK G1044 · MISP Galaxy
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage. Use this via MCP