SentinelOne's midyear assessment of the Iran War cyber threat landscape
SentinelOne has released its midyear assessment of the Iran War cyber threat landscape, refining the group’s April initial assessment with three months of additional evidence on APT42/MOIS, IRGC, and persona activity. The update tracks APT42’s continued use of AI-assisted spear phishing against U.S. organizations, a capability the group has now paired with Gemini for persona crafting and malware development. SentinelOne’s report confirms the actor’s shift from translation-only AI to full rapport-building phishing, where a target’s biography is fed to the LLM to generate a coherent persona across multiple messages, languages, and channels. The assessment also covers the IRGC-IO-linked high-trust social engineering and cloud collection pattern, where APT42 limits actions to built-in cloud features, clears Chrome history after document review, and exfiltrates files to OneDrive using the victim’s own email address. The midyear drop adds Cavern Manticore’s service-provider and RMM pathway, which res while adding AppDomainManager hijacking, and confirms the conflict increased tempo without creating the espionage mission. SentinelOne notes that APT42’s AI use doesn’t change the group’s phishing model but makes it more effective, with language quality now a weak indicator for the multi-message engagement pattern the actor has relied on since 2015.
APT42's AI-assisted spear phishing
APT42 is running AI-assisted spear phishing against U.S. organizations in the current Iran–U.S. war, according to researchers at DarkAtlas. The group feeds a target’s biography into a large language model to generate a coherent persona that sustains the multi-message engagement pattern the actor has used since 2015. The LLM handles persona crafting, language translation, and channel switching across the conversation, so the attacker can hold a believable role across multiple messages, languages, and communication channels without manual translation or copy-paste.
The AI layer doesn’t change APT42’s phishing model. The group still relies on the victim to accept a relationship, open a prompt, click a link, or submit credentials. What changes is the effectiveness: the LLM generates natural-sounding non-native English and maintains persona consistency across the extended social engineering sequence. Translation tools have been in the group’s toolkit for years, but generative AI makes the persona harder to spot because the language quality no longer tracks with a human operator. The researchers note that language quality is now a weak phishing indicator for this engagement pattern.
The TAMECAT malware chain
The recent TAMECAT activity gives APT42 a more resilient backdoor for the current campaign, with the actor now pairing it against the existing Nicecurl VBScript stage. TAMECAT is a PowerShell-based backdoor that handles arbitrary C# script execution, base64-obfuscated C2, dynamic config updates, and environment checks before execution to evade AV and active security tooling. The chain still depends on the victim accepting a relationship, opening a prompt, clicking a link, or submitting credentials — the AI layer changes the persona, not the interaction model.
Who was hit
Mandiant first documented APT42 in September 2022, reporting the group as active since 2015 with at least 30 operations across 14 countries. The espionage actor is believed to be affiliated with the IRGC-IO and has been observed targeting non-governmental organizations, media outlets, educational institutes, activists, and legal services.
The group impersonates a set of media organizations in its spear-phishing lures: the Washington Post (U.S.), The Economist (UK), The Jerusalem Post (Israel), Khaleej Times (UAE), and Azadliq (Azerbaijan). Mandiant notes the attacks often use typosquatted domains, such as washin gtonpost[.], to blend with the legitimate organization’s URL.
The backdoor malware
Google threat analysts tracking APT42’s operations report that the group delivers two custom backdoors through malicious emails: Nicecurl and Tamecat. The pair provides command execution and data exfiltration on the infected host.
Nicecurl is a VBScript-based backdoor that handles command execution, downloads and executes additional payloads, or performs data mining on the target. It is the lighter stage in the chain.
Tamecat is the more complex PowerShell backdoor. It executes arbitrary PowerShell code or C# scripts, giving APT42 the operational flexibility to perform data theft and extensive system manipulation. Compared to Nicecurl, it obfuscates C2 communication with base64, updates its configuration dynamically, and runs environment checks before execution to evade AV and active security tooling.
Key points
- SentinelOne's midyear assessment refines the April initial assessment with three months of evidence on APT42/MOIS, IRGC, and persona activity.
- APT42 is using AI-assisted spear phishing (TAMECAT) to target U.S. organizations, with Gemini used for persona crafting and malware development.
- TAMECAT is a PowerShell backdoor with base64-obfuscated C2, dynamic config, and environment checks; Nicecurl is the VBScript companion for command execution and data mining.
- APT42 targets journalists, researchers, NGOs, academics, and government-linked individuals via recruitment-themed social engineering, exfiltrating to OneDrive via ExpressVPN and Cloudflare domains.
- The conflict has increased tempo without creating a new espionage mission; high-trust personas are now part of the enterprise perimeter.