[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuqo8ibidV7SIvo_W4QDH3OZOZISTEyWVqTI9UDSId1o":3,"$fl3dXz2h-nGtuKZcHG_XcYTAhQQfralONu7uzPnlNOFo":57},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":53,"created_at":54,"updated_at":55,"published_at":56},"google-apt42-deploys-nicecurl-and-tamecat-backdoors-via-journalist-spear-phishin","Google: APT42 Deploys Nicecurl and Tamecat Backdoors via Journalist Spear-Phishing","Iranian IRGC-IO group uses typosquatted journalist domains to drop two custom backdoors on Western and Middle Eastern targets.","Google threat analysts report APT42 (Charming Kitten) is running spear-phishing campaigns that impersonate journalists and NGOs to deploy Nicecurl (VBScript) and Tamecat (PowerShell) backdoors for command execution and data exfiltration.",[10,11,12,13,14,15],"APT42","Charming Kitten","Nicecurl","Tamecat","spear-phishing","IRGC-IO","# Google: APT42 Deploys Nicecurl and Tamecat Backdoors via Journalist Spear-Phishing\n\n*Iranian IRGC-IO group uses typosquatted journalist domains to drop two custom backdoors on Western and Middle Eastern targets.*\n\n**Tags:** `APT42` `Charming Kitten` `Nicecurl` `Tamecat` `spear-phishing` `IRGC-IO`\n\n> Google threat analysts report APT42 (Charming Kitten) is running spear-phishing campaigns that impersonate journalists and NGOs to deploy Nicecurl (VBScript) and Tamecat (PowerShell) backdoors for command execution and data exfiltration.\n\n---\n\n## Journalist-themed spear-phishing\n\nAPT42 is running a journalist-themed spear-phishing campaign that impersonates five major media outlets to deliver its custom backdoors. The emails arrive from typosquatted domains of the Washington Post, The Economist, the Jerusalem Post, Khaleej Times, and Azadliq, with the actor crafting lookalike URLs like `washin gtonpost[.]` to slip past visual inspection.\n\nThe social engineering layer poses as a journalist, NGO representative, or event organizer to trigger user engagement. Targets are Western and Middle Eastern organizations across NGOs, media, education, and legal services. Once the victim opens the attachment or link, APT42 drops two backdoors: Nicecurl, a VBScript handler for command execution and payload staging, and Tamecat, a PowerShell workhorse that runs arbitrary C# and base64-obfuscates its C2 traffic. Tamecat also probes the environment before execution to dodge AV and other active security checks.\n\nThe actor limits post-exploitation to built-in cloud features, clears Chrome history after document review, and exfiltrates files to OneDrive using the victim’s own email address. All C2 traffic routes through ExpressVPN nodes, Cloudflare-hosted domains, and ephemeral VPS servers to keep attribution friction high.\n\n## Two custom backdoors: Nicecurl and Tamecat\n\nNicecurl is a VBScript backdoor that handles the initial command execution, payload download, and data mining on the infected host. It runs as a single script that APT42 drops after the victim opens the attachment, giving the actor a lightweight entry point for basic post-exploitation tasks.\n\nTamecat is the heavier PowerShell backdoor. It executes arbitrary PowerShell code or C# scripts, which gives APT42 the operational flexibility to run more complex payloads for data theft and system manipulation. The C2 channel is base64-obfuscated, and the backdoor can update its configuration dynamically at runtime. Before it executes, Tamecat probes the environment to check for active AV and other security mechanisms, reducing the chance of a detection hit on first run.\n\n## Who was hit\n\nThe campaign targets Western and Middle Eastern organizations across six primary industries: government, IT, logistics, maritime, transportation, and media. Within those verticals, APT42 has been observed hitting non-governmental organizations, media outlets, educational institutes, activists, and legal services firms. The actor’s choice of impersonated senders—Washington Post, The Economist, Jerusalem Post, Khaleej Times, and Azadliq—maps directly to the media and NGO-heavy target set, with each typosquatted domain matching the claimed sender’s real web presence.\n\n## Evasion and exfiltration\n\nThe actor keeps post-exploitation deliberately low-key. Instead of dropping a full framework or running a long PowerShell one-liner, APT42 sticks to the built-in features of the cloud tools it already has access to. That means file operations, document opens, and data pulls all look like normal user activity in the cloud console or web client.\n\nAfter reviewing a document, the actor clears the local Google Chrome history. The file is opened, read, and then the history entry is wiped so the victim’s browser no longer shows the artifact that triggered the exfil.\n\nFor the actual data pull, APT42 pushes files to a OneDrive account using an email address that appears to belong to the victimized organization. The actor does not use a generic `apt42[.]` or a known C2 domain; it registers or reuses a mailbox that matches the target’s own domain, so the OneDrive URL in the browser or email client looks like it came from the same org.\n\nAll C2 traffic routes through a three-layer egress chain. ExpressVPN nodes handle the outbound leg, Cloudflare-hosted domains serve the C2 and payload URLs, and ephemeral VPS servers close the loop for the final interaction. The actor spins up a fresh VPS for each session, so the IP and ASN change per target, keeping attribution friction high across the full kill chain.\n\n## Key points\n\n- APT42 sends spear-phishing emails from typosquatted domains impersonating Washington Post, The Economist, Jerusalem Post, Khaleej Times, and Azadliq.\n- Nicecurl is a VBScript backdoor handling command execution, payload download, and data mining.\n- Tamecat is a PowerShell backdoor with base64-obfuscated C2, dynamic config updates, and environment checks for AV evasion.\n- Targets include NGOs, media outlets, educational institutes, activists, and legal services in Western and Middle Eastern countries.\n- APT42 uses ExpressVPN, Cloudflare domains, and ephemeral VPS servers to reduce attribution signals.\n\n## Further reading & sources\n\n- [Iranian hackers pose as journalists to push backdoor malware](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Firanian-hackers-pose-as-journalists-to-push-backdoor-malware\u002F)\n- [AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict](https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Firan-ai-asymmetric-playbook)\n- [Iranian APT Launches AI-Assisted Spear Phishing Attacks](https:\u002F\u002Fblog.knowbe4.com\u002Firanian-apt42-ai-assisted-spear-phishing)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgoogle-apt42-deploys-nicecurl-and-tamecat-backdoors-via-journalist-spear-phishin.png?v=a73732edbd",{"actors":19,"malware":26,"targets":31,"timeline":37,"industries":42,"technologies":46},[20],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Fapt42","apt42","apt","Iran (IRGC Intelligence Organization \u002F IRGC-IO)","espionage",[27,29,30],{"name":28},"CHAR",{"name":13},{"name":12},[32],{"name":33,"sector":34,"status":35,"geography":36},"Washington Post","media","targeted","U.S.",[38],{"date":39,"event":40,"description":41},"2026-08-13","Blog post","KnowBe4 blog post announcing APT42 AI-assisted spear phishing",[43],{"url":44,"name":45,"slug":34},"\u002Findustries\u002Fmedia","Media",[47,50],{"vendor":48,"product":49},"Google","Chrome",{"vendor":51,"product":52},"Microsoft","OneDrive","threat_actor_activity","2026-09-19T17:04:11.454764+00:00","2026-10-16T12:28:23.134446+00:00",null,{"articles":58},[59,71,84,95],{"slug":60,"title":61,"summary":62,"tags":63,"hero_image_url":69,"story_type":53,"created_at":70},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.",[64,65,66,67,14,68],"Armored Likho","BusySnake Stealer","Kaspersky","APT","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":72,"title":73,"summary":74,"tags":75,"hero_image_url":82,"story_type":53,"created_at":83},"fortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-","FortiGuard Labs flags UNC1549 for spear-phishing and VDI abuse against European aerospace and telecom targets","FortiGuard Labs published an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group targeting aerospace, defense, and telecom organizations in Europe with spear-phishing, credential theft, and VDI abuse for initial access and lateral movement.",[76,77,78,14,79,80,81],"UNC1549","FortiGuard Labs","Iran","VDI","CVE-2021-26855","CVE-2020-0688","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-.png?v=31f9fd4fc4","2026-08-31T07:09:49.726163+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":93,"story_type":53,"created_at":94},"sentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence","SentinelOne Refines APT42 Iran War Assessment with Three Months of New Evidence","SentinelOne's midyear assessment of the Iran War cyber threat landscape refines their April initial assessment with three months of evidence on APT42\u002FMOIS, IRGC, and persona activity, including AI-assisted spear phishing and TAMECAT backdoor deployment.",[10,78,89,90,91,92],"MOIS","IRGC","TAMECAT","Spear Phishing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence.png?v=3a584a829a","2026-08-29T12:17:25.675495+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":106,"story_type":53,"created_at":107},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[100,101,102,103,104,105],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00"]