[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fva4Iy9fiGVj6n2saMr1OmcdKuAx4c6q1rCq2pdnvn-A":3,"$faTTbpZvAY_DnXQsOQkg4ObdnkAHuqYg5bF8FYjzvJAA":67},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":63,"created_at":64,"updated_at":65,"published_at":66},"sentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence","SentinelOne Refines APT42 Iran War Assessment with Three Months of New Evidence","Midyear update adds AI-assisted spear phishing, TAMECAT malware, and IRGC-IO cloud collection to the April initial assessment.","SentinelOne's midyear assessment of the Iran War cyber threat landscape refines their April initial assessment with three months of evidence on APT42\u002FMOIS, IRGC, and persona activity, including AI-assisted spear phishing and TAMECAT backdoor deployment.",[10,11,12,13,14,15],"APT42","Iran","MOIS","IRGC","TAMECAT","Spear Phishing","# SentinelOne Refines APT42 Iran War Assessment with Three Months of New Evidence\n\n*Midyear update adds AI-assisted spear phishing, TAMECAT malware, and IRGC-IO cloud collection to the April initial assessment.*\n\n**Tags:** `APT42` `Iran` `MOIS` `IRGC` `TAMECAT` `Spear Phishing`\n\n> SentinelOne's midyear assessment of the Iran War cyber threat landscape refines their April initial assessment with three months of evidence on APT42\u002FMOIS, IRGC, and persona activity, including AI-assisted spear phishing and TAMECAT backdoor deployment.\n\n---\n\n## SentinelOne's midyear assessment of the Iran War cyber threat landscape\n\nSentinelOne has released its midyear assessment of the Iran War cyber threat landscape, refining the group’s April initial assessment with three months of additional evidence on APT42\u002FMOIS, IRGC, and persona activity. The update tracks APT42’s continued use of AI-assisted spear phishing against U.S. organizations, a capability the group has now paired with Gemini for persona crafting and malware development. SentinelOne’s report confirms the actor’s shift from translation-only AI to full rapport-building phishing, where a target’s biography is fed to the LLM to generate a coherent persona across multiple messages, languages, and channels. The assessment also covers the IRGC-IO-linked high-trust social engineering and cloud collection pattern, where APT42 limits actions to built-in cloud features, clears Chrome history after document review, and exfiltrates files to OneDrive using the victim’s own email address. The midyear drop adds Cavern Manticore’s service-provider and RMM pathway, which res while adding AppDomainManager hijacking, and confirms the conflict increased tempo without creating the espionage mission. SentinelOne notes that APT42’s AI use doesn’t change the group’s phishing model but makes it more effective, with language quality now a weak indicator for the multi-message engagement pattern the actor has relied on since 2015.\n\n## APT42's AI-assisted spear phishing\n\nAPT42 is running AI-assisted spear phishing against U.S. organizations in the current Iran–U.S. war, according to researchers at DarkAtlas. The group feeds a target’s biography into a large language model to generate a coherent persona that sustains the multi-message engagement pattern the actor has used since 2015. The LLM handles persona crafting, language translation, and channel switching across the conversation, so the attacker can hold a believable role across multiple messages, languages, and communication channels without manual translation or copy-paste.\n\nThe AI layer doesn’t change APT42’s phishing model. The group still relies on the victim to accept a relationship, open a prompt, click a link, or submit credentials. What changes is the effectiveness: the LLM generates natural-sounding non-native English and maintains persona consistency across the extended social engineering sequence. Translation tools have been in the group’s toolkit for years, but generative AI makes the persona harder to spot because the language quality no longer tracks with a human operator. The researchers note that language quality is now a weak phishing indicator for this engagement pattern.\n\n## The TAMECAT malware chain\n\nThe recent TAMECAT activity gives APT42 a more resilient backdoor for the current campaign, with the actor now pairing it against the existing Nicecurl VBScript stage. TAMECAT is a PowerShell-based backdoor that handles arbitrary C# script execution, base64-obfuscated C2, dynamic config updates, and environment checks before execution to evade AV and active security tooling. The chain still depends on the victim accepting a relationship, opening a prompt, clicking a link, or submitting credentials — the AI layer changes the persona, not the interaction model.\n\n## Who was hit\n\nMandiant first documented APT42 in September 2022, reporting the group as active since 2015 with at least 30 operations across 14 countries. The espionage actor is believed to be affiliated with the IRGC-IO and has been observed targeting non-governmental organizations, media outlets, educational institutes, activists, and legal services.\n\nThe group impersonates a set of media organizations in its spear-phishing lures: the Washington Post (U.S.), The Economist (UK), The Jerusalem Post (Israel), Khaleej Times (UAE), and Azadliq (Azerbaijan). Mandiant notes the attacks often use typosquatted domains, such as `washin gtonpost[.]`, to blend with the legitimate organization’s URL.\n\n## The backdoor malware\n\nGoogle threat analysts tracking APT42’s operations report that the group delivers two custom backdoors through malicious emails: **Nicecurl** and **Tamecat**. The pair provides command execution and data exfiltration on the infected host.\n\nNicecurl is a VBScript-based backdoor that handles command execution, downloads and executes additional payloads, or performs data mining on the target. It is the lighter stage in the chain.\n\nTamecat is the more complex PowerShell backdoor. It executes arbitrary PowerShell code or C# scripts, giving APT42 the operational flexibility to perform data theft and extensive system manipulation. Compared to Nicecurl, it obfuscates C2 communication with base64, updates its configuration dynamically, and runs environment checks before execution to evade AV and active security tooling.\n\n## Key points\n\n- SentinelOne's midyear assessment refines the April initial assessment with three months of evidence on APT42\u002FMOIS, IRGC, and persona activity.\n- APT42 is using AI-assisted spear phishing (TAMECAT) to target U.S. organizations, with Gemini used for persona crafting and malware development.\n- TAMECAT is a PowerShell backdoor with base64-obfuscated C2, dynamic config, and environment checks; Nicecurl is the VBScript companion for command execution and data mining.\n- APT42 targets journalists, researchers, NGOs, academics, and government-linked individuals via recruitment-themed social engineering, exfiltrating to OneDrive via ExpressVPN and Cloudflare domains.\n- The conflict has increased tempo without creating a new espionage mission; high-trust personas are now part of the enterprise perimeter.\n\n## Further reading & sources\n\n- [Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters | SentinelOne](https:\u002F\u002Fwww.sentinelone.com\u002Flabs\u002Firan-war-cyber-threat-landscape-a-midyear-assessment-on-what-matters) — SentinelLabs\n- [Iranian APT Launches AI-Assisted Spear Phishing Attacks](https:\u002F\u002Fblog.knowbe4.com\u002Firanian-apt42-ai-assisted-spear-phishing)\n- [AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict](https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Firan-ai-asymmetric-playbook)\n- [Iranian hackers pose as journalists to push backdoor malware](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Firanian-hackers-pose-as-journalists-to-push-backdoor-malware\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence.png?v=3a584a829a",{"actors":19,"malware":32,"targets":37,"timeline":43,"industries":52,"technologies":56},[20,26],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Fapt42","apt42","apt","Iran (IRGC Intelligence Organization \u002F IRGC-IO)","espionage",{"url":27,"name":28,"slug":29,"type":30,"origin":11,"motivation":31},"\u002Fthreat-groups\u002Fcavern-manticore","Cavern Manticore","cavern-manticore","unknown","Espionage",[33,35],{"name":34},"Tamecat",{"name":36},"Nicecurl",[38],{"name":39,"sector":40,"status":41,"geography":42},"Washington Post","media","targeted","U.S.",[44,48],{"date":45,"event":46,"description":47},"2026-06-23","Incident","Second reported attack disrupted card services at three of the same banks",{"date":49,"event":50,"description":51},"2026-08-13","Blog post","KnowBe4 blog post announcing APT42 AI-assisted spear phishing",[53],{"url":54,"name":55,"slug":40},"\u002Findustries\u002Fmedia","Media",[57,60],{"vendor":58,"product":59},"Google","Chrome",{"vendor":61,"product":62},"Microsoft","OneDrive","threat_actor_activity","2026-08-29T12:17:25.675495+00:00","2026-10-16T12:29:03.209669+00:00",null,{"articles":68},[69,79,90,105],{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":77,"story_type":63,"created_at":78},"google-apt42-deploys-nicecurl-and-tamecat-backdoors-via-journalist-spear-phishin","Google: APT42 Deploys Nicecurl and Tamecat Backdoors via Journalist Spear-Phishing","Google threat analysts report APT42 (Charming Kitten) is running spear-phishing campaigns that impersonate journalists and NGOs to deploy Nicecurl (VBScript) and Tamecat (PowerShell) backdoors for command execution and data exfiltration.",[10,74,36,34,75,76],"Charming Kitten","spear-phishing","IRGC-IO","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgoogle-apt42-deploys-nicecurl-and-tamecat-backdoors-via-journalist-spear-phishin.png?v=a73732edbd","2026-09-19T17:04:11.454764+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":88,"story_type":63,"created_at":89},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater Disguises Espionage Campaign as Chaos Ransomware","MuddyWater used Chaos ransomware branding to mask a state-sponsored espionage operation that included credential theft, data exfiltration, and a leak-site entry, with initial access delivered through Microsoft Teams social engineering.",[84,85,86,87,11],"MuddyWater","Chaos Ransomware","Rapid7","Microsoft Teams","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb","2026-09-02T07:19:02.642087+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":103,"story_type":63,"created_at":104},"fortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir","FortiGuard Labs Flags Handala Exploiting Six Vendor Vulnerabilities in Active Iran Campaign","FortiGuard Labs issued an Outbreak Alert for the Handala group, an Iran-linked actor, actively exploiting critical vulnerabilities across six major vendor products in a sustained campaign.",[95,96,11,97,61,98,99,100,101,102],"Handala","FortiGuard","Outbreak Alert","Oracle","Apache","Hikvision","Atlassian","Ivanti","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir.png?v=6da17f1ec2","2026-08-31T12:10:30.775227+00:00",{"slug":106,"title":107,"summary":108,"tags":109,"hero_image_url":115,"story_type":63,"created_at":116},"fortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-","FortiGuard Labs flags UNC1549 for spear-phishing and VDI abuse against European aerospace and telecom targets","FortiGuard Labs published an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group targeting aerospace, defense, and telecom organizations in Europe with spear-phishing, credential theft, and VDI abuse for initial access and lateral movement.",[110,111,11,75,112,113,114],"UNC1549","FortiGuard Labs","VDI","CVE-2021-26855","CVE-2020-0688","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-.png?v=31f9fd4fc4","2026-08-31T07:09:49.726163+00:00"]