Israel disclosed SpearSpecter: an IRGC-IO espionage campaign using weeks-long WhatsApp social engineering and search-ms/WebDAV abuse to deploy the fileless TAMECAT PowerShell backdoor with Discord/Telegram C2.

APT42 launched "SpearSpecter," a campaign targeting defense officials and their relatives. It uses personalized social engineering and the stealthy, PowerShell-based TAMECAT malware.

APT42 targets defense officials with "TAMECAT," a modular PowerShell backdoor. The malware uses social engineering and Telegram C2 to steal secrets.

Proofpoint reveals Iran-aligned TA453 is exploiting Operation Epic Fury to launch targeted credential phishing campaigns against U.S. think tanks.

The Strategic Value of Silent Persistence Iranian threat actors operate with significantly greater stealth than conventionally perceived. Rather than executing immediate, high-profile disruptive a…

At a glance Actor or group APT42 (Iran-linked; also tracked as TA453) Activity type AI-assisted spear-phishing, credential theft, TAMECAT backdoor delivery Targets or victims Defense and governmen…