CALANQUE
Named by NoneSuspected state sponsor: Islamic Republic of IranCALANQUE is Google Threat Analysis Group's (TAG) tracking designation for the Iranian espionage actor known as APT42. Active since at least 2019, the group conducts credential harvesting and cloud intrusion operations against journalists, NGOs, activists, and government officials in the Middle East, Europe, and the United States. CALANQUE operations are characterized by the use of fake login pages mimicking Google, Microsoft, and Yahoo services, delivered via spear phishing emails that impersonate legitimate news outlets and organizations. The cluster is assessed to operate on behalf of the IRGC-IO.
Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.