Journalist-themed spear-phishing
APT42 is running a journalist-themed spear-phishing campaign that impersonates five major media outlets to deliver its custom backdoors. The emails arrive from typosquatted domains of the Washington Post, The Economist, the Jerusalem Post, Khaleej Times, and Azadliq, with the actor crafting lookalike URLs like washin gtonpost[.] to slip past visual inspection.
The social engineering layer poses as a journalist, NGO representative, or event organizer to trigger user engagement. Targets are Western and Middle Eastern organizations across NGOs, media, education, and legal services. Once the victim opens the attachment or link, APT42 drops two backdoors: Nicecurl, a VBScript handler for command execution and payload staging, and Tamecat, a PowerShell workhorse that runs arbitrary C# and base64-obfuscates its C2 traffic. Tamecat also probes the environment before execution to dodge AV and other active security checks.
The actor limits post-exploitation to built-in cloud features, clears Chrome history after document review, and exfiltrates files to OneDrive using the victim’s own email address. All C2 traffic routes through ExpressVPN nodes, Cloudflare-hosted domains, and ephemeral VPS servers to keep attribution friction high.
Two custom backdoors: Nicecurl and Tamecat
Nicecurl is a VBScript backdoor that handles the initial command execution, payload download, and data mining on the infected host. It runs as a single script that APT42 drops after the victim opens the attachment, giving the actor a lightweight entry point for basic post-exploitation tasks.
Tamecat is the heavier PowerShell backdoor. It executes arbitrary PowerShell code or C# scripts, which gives APT42 the operational flexibility to run more complex payloads for data theft and system manipulation. The C2 channel is base64-obfuscated, and the backdoor can update its configuration dynamically at runtime. Before it executes, Tamecat probes the environment to check for active AV and other security mechanisms, reducing the chance of a detection hit on first run.
Who was hit
The campaign targets Western and Middle Eastern organizations across six primary industries: government, IT, logistics, maritime, transportation, and media. Within those verticals, APT42 has been observed hitting non-governmental organizations, media outlets, educational institutes, activists, and legal services firms. The actor’s choice of impersonated senders—Washington Post, The Economist, Jerusalem Post, Khaleej Times, and Azadliq—maps directly to the media and NGO-heavy target set, with each typosquatted domain matching the claimed sender’s real web presence.
Evasion and exfiltration
The actor keeps post-exploitation deliberately low-key. Instead of dropping a full framework or running a long PowerShell one-liner, APT42 sticks to the built-in features of the cloud tools it already has access to. That means file operations, document opens, and data pulls all look like normal user activity in the cloud console or web client.
After reviewing a document, the actor clears the local Google Chrome history. The file is opened, read, and then the history entry is wiped so the victim’s browser no longer shows the artifact that triggered the exfil.
For the actual data pull, APT42 pushes files to a OneDrive account using an email address that appears to belong to the victimized organization. The actor does not use a generic apt42[.] or a known C2 domain; it registers or reuses a mailbox that matches the target’s own domain, so the OneDrive URL in the browser or email client looks like it came from the same org.
All C2 traffic routes through a three-layer egress chain. ExpressVPN nodes handle the outbound leg, Cloudflare-hosted domains serve the C2 and payload URLs, and ephemeral VPS servers close the loop for the final interaction. The actor spins up a fresh VPS for each session, so the IP and ASN change per target, keeping attribution friction high across the full kill chain.
Key points
- APT42 sends spear-phishing emails from typosquatted domains impersonating Washington Post, The Economist, Jerusalem Post, Khaleej Times, and Azadliq.
- Nicecurl is a VBScript backdoor handling command execution, payload download, and data mining.
- Tamecat is a PowerShell backdoor with base64-obfuscated C2, dynamic config updates, and environment checks for AV evasion.
- Targets include NGOs, media outlets, educational institutes, activists, and legal services in Western and Middle Eastern countries.
- APT42 uses ExpressVPN, Cloudflare domains, and ephemeral VPS servers to reduce attribution signals.