Threat Actor 🇮🇷 Iran

APT42

Also known as: UNC788 · CALANQUE

Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.

Indicators of Compromise 1

Domain studiotikva[.]com

MITRE ATT&CK TTPs 7

T1001.002
Steganography
Command And Control
 T1027
Obfuscated Files or Information
Defense Evasion
 T1071.004
DNS
Command And Control
 T1090.003
Multi-hop Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1132.001
Standard Encoding
Command And Control
 T1558.003
Kerberoasting
Credential Access

Source Articles

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Iranian nation-state actors linked to Cavern (aka Cav3rn) C2 framework have evolved their infrastructure to blend malicious traffic with legitimate services, using DNS A-record queries to dynamically switch between direct HTTPS and Google Apps Script relays for command-and-control. A new module, HOLLOWGRAPH, abuses Microsoft 365 calendars via the Graph API to exfiltrate data and receive commands, with events scheduled far into the future to avoid detection. The framework uses a modular architecture with components like GoogleService.dll and rnp.dll, leveraging legitimate cloud services to evade perimeter defenses and maintain persistence.
hacker-news ·5h ago