Actors Insights|Latest update04/07/2026

TA453

Named by ProofpointSuspected state sponsor: Islamic Republic of Iran

TA453 is Proofpoint's designation for the Iranian state-sponsored threat actor widely known as APT42, linked to Iran's Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). Active since at least 2014, TA453 is known for highly targeted spear phishing campaigns using elaborate social engineering — including multi-persona impersonation and fake conference invitations — to harvest credentials from journalists, academics, human rights activists, and policy experts. Proofpoint has documented the group's use of malware families such as HYPERSCRAPE and novel infection chains targeting both Windows and macOS platforms.

First Seen:Jan 2014
Last Seen:Mar 2026
Indexed Reports:9
Public IOCs:64
Cluster: APT42Mitre: Magic HoundMisp: TA453
also known as:
TA453 (Proofpoint)Magic Hound (Palo Alto)COBALT ILLUSION (SecureWorks)Charming Kitten (CrowdStrike)ITG18 (IBM)PHOSPHORUS (Microsoft)Newscaster (Symantec)APT35 (Mandiant)Mint Sandstorm (Microsoft)G0059 (Mitre)

Targeted Regions

Europe
EU
Europe
Europe
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Iran
IR
Iran
Iran
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Israel
IL
Israel
Israel
Dec 2020 ~ Dec 2022
Dec 2020 ~ Mar 2021
Dec 2020 ~ Dec 2022
Dec 2020 ~ Mar 2021
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Feb 2024 ~ Aug 2024
Feb 2024 ~ Aug 2024
Feb 2024 ~ Aug 2024
Middle East
ME
Middle East
Middle East
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Dec 2020 ~ Dec 2022
Jun 2022 ~ Sep 2022
Dec 2020 ~ Dec 2022
Jun 2022 ~ Sep 2022
Dec 2020 ~ Dec 2022
Jun 2022 ~ Sep 2022
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2021 ~ Jul 2022
Sep 2021 ~ Jul 2022
Sep 2021 ~ Jul 2022
Sep 2021 ~ Jul 2022
Sep 2021 ~ Jul 2022
United Kingdom
GB
United Kingdom
United Kingdom
Jan 2021 ~ Jul 2021
Jan 2021 ~ Jul 2021
Jan 2021 ~ Jul 2021
Jun 2022 ~ Sep 2022
Jun 2022 ~ Sep 2022
Jun 2022 ~ Sep 2022
Jan 2023 ~ Jan 2023
United States
US
United States
United States
Dec 2020 ~ Dec 2022
Dec 2020 ~ Mar 2021
Jan 2021 ~ Jul 2021
Dec 2020 ~ Dec 2022
Dec 2020 ~ Mar 2021
Jan 2021 ~ Jul 2021
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Jan 2021 ~ Jul 2021
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Sep 2021 ~ Jul 2023
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Sep 2021 ~ Jul 2023
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Jun 2022 ~ Sep 2022
Sep 2021 ~ Jul 2023
Sep 2021 ~ Jul 2022
Dec 2020 ~ Dec 2022
Jun 2022 ~ Sep 2022
Sep 2021 ~ Jul 2023
Dec 2020 ~ Dec 2022
Jun 2022 ~ Sep 2022
Sep 2021 ~ Jul 2023
Sep 2021 ~ Jul 2023
Sep 2021 ~ Jul 2023
Sep 2021 ~ Jul 2023
Feb 2026 ~ Mar 2026
Dec 2020Oct 2026

Targeted Sectors

ResearchersPoliticalJournalistsGovernment Agencies and ServicesEnergyMediaMedicalScientific ResearchDefenseReligiousHuman RightsMilitaryReal EstateAerospaceTourismHealthcare

Recent Indexed Reports

  1. Public
    TA453 Maintains Credential Phishing Operations Against US Think Tanks Amid Middle East Conflict
  2. Public
    TA453 Targets Jewish Religious Leader with Sophisticated BlackSmith Malware
  3. Public
    TA453 Campaign Deploys Novel PowerShell Backdoor and Mac-Specific Malware
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.