APT42

Targets

Regions: Middle East

Known techniques

• T1016System Network Configuration Discovery
• T1036.005Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1053.005Scheduled Task
• T1056Input Capture
• T1056.001Keylogging
• T1059.001PowerShell
• T1059.005Visual Basic
• T1070Indicator Removal
• T1070.008Clear Mailbox Data
• T1071.001Web Protocols
• T1082System Information Discovery
• T1087.001Local Account
• T1102Web Service
• T1111Multi-Factor Authentication Interception
• T1112Modify Registry
• T1113Screen Capture
• T1132.001Standard Encoding
• T1518.001Security Software Discovery
• T1530Data from Cloud Storage
• T1539Steal Web Session Cookie
• T1547Boot or Logon Autostart Execution
• T1555.003Credentials from Web Browsers
• T1566.002Spearphishing Link
• T1573.002Asymmetric Cryptography
• T1583.001Domains
• T1583.003Virtual Private Server
• T1585.002Email Accounts
• T1588.002Tool
• T1608.001Upload Malware
• T1682Query Public AI Services
• T1684.001Impersonation
• T1697Steal Application Specific Passwords

Malware and tools used