aol.pm

APT42

IntrusionSet · ATTACK:enterprise:G1044

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G1044",
  "title": "APT42",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1044",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--c0291346-defe-48d7-9542-9e074ba1bdfb",
  "external_id": "G1044",
  "domain": "enterprise",
  "created": "2025-01-08T17:08:26.378Z",
  "modified": "2026-09-22T18:32:31.345Z",
  "version": "1.1",
  "aliases": [
    "APT42"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Mandiant APT42-charms",
      "url": "https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"
    },
    {
      "source_name": "Mandiant APT42-untangling",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01563b41-e89b-4cd2-b018-ee57bf616396

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:S1192

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a393ae5-9031-4672-85f0-a4f675e3a1fa

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2211993c-fe8d-4bd7-a312-44187566ae65

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29878d2d-b66f-488f-a721-d6b44885ef66

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3022f4d3-c2b9-4937-96ae-f4d86ba89bb8

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1056

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37f4170b-b4ea-470b-8ee6-ff15ba35d472

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b8a0295-1b56-4d78-bf91-ed275a7ff55b

TAG APT42 · Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4211ef16-7a9e-49b8-92c4-b73cbef0f843

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42e7fe7a-6fa3-420f-8d07-435832813791

Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51e59a65-1ca2-4649-afa0-f9244d323315

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1697

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56c4a20a-81a1-4042-8a6f-2fef460de20a

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58d20f74-b41a-45c3-b6de-41a3d6cf86e0

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:S1193

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6507afbb-d576-4392-b5c0-afcb4dd73e3d

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fc6386b-9e04-4f20-aae6-a18ae3025391

TAG APT42 · Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76c608c9-5915-4182-a168-a2d02a596c36

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--776fa02f-a4f2-43e1-b2f6-d84c4a749045

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b5386dc-ebc3-4acd-ad70-833ed3fedd61

TAG APT42

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83c0f19f-e827-4e82-b771-a322fbe2b337

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1682

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86b818d3-e834-47b2-b944-24ed7f088916

GTIG AI Threat Tracker

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1070.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a69a3f1a-a912-41e2-b4b5-c320638ce858

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaf34dd8-3ce7-4c6a-b4f1-c87dc7262e9f

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1eec91d-73d9-421d-b271-c7e1753a0c1e

TAG APT42 · Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c140a027-1994-4e00-a9f9-8c407f22b486

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c279fb4c-666a-402c-b911-e9e5eddb51fe

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca88bb6a-5f55-4303-aad9-a8715ba69c41

Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3c2dfe5-1038-4b71-bcc4-5d74cb5ef3f5

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddd5f16a-68c9-44fd-a5d1-b43b8f6ea79d

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1062063-0f27-443e-9d6f-2dee44ee79aa

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e601b4ad-f260-49a9-9642-4ed7c66e91b9

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e98b3b9a-c152-4515-bd01-273788561548

Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea2bea46-e1fd-4edf-bba7-8d0552e1975f

Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1547

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb537310-fa06-4bde-a074-ed3234ec1a27

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eebf3764-7500-4798-9a78-3119691a3170

Mandiant APT42-charms

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f565693e-80f4-40a8-8f28-f1a9bd0d1918

TAG APT42 · Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb4daaf8-3e27-4ec5-b2e0-932e8fa906c5

Mandiant APT42-charms

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.