APT42: Iran's Social Engineering Specialists — From Journalist Impersonation to Election Interference

The group that targets people, not systems.

APT42 — also tracked as Charming Kitten, Mint Sandstorm, TA453, Yellow Garuda, ITG18, and Educated Manticore — is an Iranian state-sponsored cyber espionage group that has been conducting operations since at least 2015. Mandiant assesses with moderate confidence that the group operates on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO), the branch of Iran's intelligence apparatus responsible for monitoring and preventing foreign threats to the Islamic Republic and suppressing domestic unrest.

What makes APT42 distinct from every other Iranian threat group — and from most nation-state actors globally — is their target selection and methodology. Where APT33 targets aerospace companies for intellectual property and APT39 targets telecoms for surveillance data, APT42 targets people. Specifically: journalists, academics, think tank researchers, human rights activists, political campaign staff, diplomats, former government officials, members of the Iranian diaspora, and anyone deemed an opponent or critic of the Iranian regime. Their weapon is not malware — it is trust.

APT42's operators are among the most skilled social engineers in the state-sponsored threat landscape. They build relationships over weeks — sometimes months — before ever sending a malicious link. They impersonate journalists, fellow academics, conference organisers, and recruiters. They communicate via email, WhatsApp, and Telegram. They research their targets extensively and craft approaches so convincing that even security-aware individuals have been compromised. In 2024, they successfully hacked the Trump presidential campaign, stole internal documents including a 271-page vice-presidential vetting dossier, and leaked the material to journalists — demonstrating capabilities that echo Russia's 2016 election interference playbook.

Connecting APT42 to the IRGC-IO.

Anyone who threatens or interests the regime.

APT42's target selection maps directly to the IRGC-IO's intelligence requirements. Their targets are not chosen for the organisations they work for, but for who they are, what they know, and who they communicate with. This makes APT42 fundamentally different from most state-sponsored groups — they conduct human intelligence collection through cyber means.

The tradecraft that makes APT42 uniquely dangerous.

APT42's defining capability is social engineering. Their operators do not simply send phishing emails — they conduct sustained, personalised manipulation campaigns that exploit human trust. The approach is methodical: identify the target, research their work and contacts, create a credible persona, initiate contact through a plausible pretext, build rapport over days to weeks, and only then deliver the credential harvesting link or malicious payload.

A critical detail: APT42's phishing kits are sophisticated enough to capture MFA tokens in real-time. When the victim enters their password and MFA code on the cloned login page, APT42's infrastructure immediately relays those credentials to the real service, establishing a session before the MFA token expires. This defeats standard time-based OTP (TOTP) and SMS-based MFA — only phishing-resistant MFA methods (FIDO2 security keys, passkeys) are immune to this technique.

From phishing to presidential campaign compromise.

In May and June 2024, APT42 targeted approximately twelve individuals associated with both the Trump and Biden/Harris presidential campaigns, including current and former government officials, political consultants, and campaign workers. Google's Threat Analysis Group (TAG) detected and publicly attributed the activity to APT42 in August 2024.

The operation drew immediate comparisons to Russia's 2016 hack of the Democratic National Committee and the Clinton campaign. The methodology was different — APT42 used social engineering and credential harvesting rather than malware-based exploitation — but the strategic objective was analogous: steal sensitive campaign materials and leak them to influence the election. US intelligence agencies assessed that Iran's efforts were motivated in part by the desire to retaliate for the January 2020 assassination of IRGC General Qasem Soleimani.

Credential harvesting kits, backdoors, and mobile surveillance.

APT42's primary tool is not malware — it is the phishing kit. Their credential harvesting infrastructure is purpose-built, regularly updated, and sophisticated enough to bypass MFA. However, the group also maintains malware capabilities for deeper operations when credential access alone is insufficient.

Protecting individuals against targeted social engineering.

Defending against APT42 is fundamentally different from defending against infrastructure-targeting groups. APT42 attacks individuals — often on their personal devices and accounts, outside the protective boundary of corporate security controls. The defences must therefore be individual-centric: hardening personal accounts, building awareness of social engineering, and providing institutional support for high-risk individuals.

APT42 within Iran's cyber ecosystem.

APT42 operates alongside several other Iranian state-sponsored groups, each serving different strategic objectives. Understanding where APT42 fits helps organisations assess which Iranian threats are relevant to their specific risk profile.

The bottom line.

APT42 is the IRGC Intelligence Organization's human-targeting specialist — a cyber espionage group whose primary weapon is not malware but trust. They invest weeks building relationships with targets, impersonate trusted contacts with remarkable skill, and deploy credential harvesting infrastructure sophisticated enough to bypass standard MFA. Their target list — journalists, academics, dissidents, political campaign staff, and human rights workers — reflects the IRGC-IO's mandate to monitor threats to the Iranian regime and collect intelligence on foreign policy decision-makers.

The 2024 US presidential election hack demonstrated APT42's capabilities at their most consequential. They compromised campaign advisers, stole internal documents, and leaked them to the media — an operation that drew direct comparisons to Russia's 2016 election interference. Three IRGC-linked individuals were indicted by the US Department of Justice. Despite the indictments, the group continues to operate.

For individuals in APT42's target categories, the defensive imperative is clear: deploy phishing-resistant MFA (security keys, not SMS codes), enrol in advanced protection programmes, verify all unsolicited professional contact through independent channels, and treat government-backed attacker warnings as genuine emergencies. APT42 does not target networks — they target the people whose accounts hold the intelligence the IRGC needs. If you work in Middle Eastern policy, nuclear security, journalism covering Iran, human rights advocacy, or political campaigns, you are a potential target, and your personal account security is a national security matter.