APT42Threat actor
- calanque
- CALANQUE ION
- unc788
Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.From MISP Galaxy
Last reported yesterday, by Risky Business News5 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1027.007Dynamic API Resolution
“Supply source code to Gemini to implement evasion and obfuscation tactics and consolidate foothold (e.g., dynamic API resolution via PEB parsing, rolling XOR encryption of C2 IP addresses).”
- T1036Masquerading
“Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities”
- T1055Process Injection
“…g assistants such as DeepSeek-Coder to develop Python-based Remote Access Trojans (RATs) incorporating cross-platform persistence, process injection, fileless execution, defense evasion, and C2 notifications.”
- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“CALANQUE ION, an Iranian government-backed actor previously tracked as APT42, continued to leverage generative AI models—including Gemini—to augment reconnaissance and targeted social engineering.”
-
July 2026 Threat Trend Report on APT Groups“APT42 used TAMECAT to collect Windows search-ms, WebDAV, browser credentials, and cookies.”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“Long-running APT42 operations have targeted journalists, researchers, NGOs, academics, activists, and government-linked individuals.”
-
AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict“In February 2026, Google’s GTIG AI Threat Tracker reported that GreenBravo (also known as APT42, Charming Kitten, Mint Sandstorm) has been using Gemini “as an engineering platform to accelerate the development of specialized malicious tools,” including for debugging, code generat…”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.