APT42: Iranian Cyber Espionage Campaign Targets Global NGO and Media Sectors

A cyber espionage group linked to the Iranian government, known as APT42, has been targeting civil society organizations, academics, journalists, and activists by stealing credentials and infiltrating their cloud accounts and devices.

The group responsible is APT42, which is believed to be working on behalf of Iran’s Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO), a major intelligence agency in the country.

APT42 aims to gather sensitive information relevant to Iran’s strategic interests, including foreign policy, human rights advocacy, and internal dissent monitoring.

Targets include NGOs, journalists, legal professionals, researchers, and activists, primarily in the U.S., Europe, Israel, and Middle Eastern countries.

APT42 tricked individuals into sharing their login details through fake emails and websites that looked like legitimate services (like Google or Microsoft). In some cases, they installed custom malware via email attachments to gain deeper access.

They often work on issues related to Iran, such as human rights, academic research, or international policy—making them of interest to Iranian intelligence services.

Use strong authentication methods (such as hardware keys), stay cautious of unexpected emails or links, and regularly monitor login activity and permissions in cloud platforms.