Iran-Aligned Cyber Groups: Tactics of APT42, MuddyWater, APT34 and Handala
Summary
CloudSek profiles four Iran-aligned groups, outlining their targets and tactics, including spear-phishing, credential theft, PowerShell, DNS tunneling, exploitation, DDoS and data leaks. It also recommends patching, hardening and monitoring.
Key points
- The article describes IRGC- and MOIS-linked operations, sometimes conducted through contractors and proxies.
- APT42 is characterized as an espionage group using tailored social engineering and credential theft to access email and cloud accounts and steal data.
- MuddyWater commonly combines spear-phishing or exploitation of exposed applications with PowerShell, legitimate Windows tools and covert command-and-control.
- APT34 is described as using custom tools, trusted relationships and supply-chain access, with DNS tunneling for command-and-control and data exfiltration.
- Handala focuses on public disruption, including DDoS, website defacement and claimed data theft and leaks.
- Recommended defenses include rapid patching, PowerShell logging and restrictions, DNS anomaly monitoring, least privilege, and endpoint and network telemetry.
Article Details
- Attack Vectors
- APT42 uses targeted spear-phishing, impersonation, fake login pages, and tailored malware droppers to compromise accounts.
- MuddyWater uses spear-phishing with malicious documents and exploits vulnerabilities in unpatched, internet-facing applications.
- APT34 uses spear-phishing and may compromise trusted third-party IT providers to gain initial access.
- Handala uses high-volume DDoS, phishing, and exploitation of public-facing web application vulnerabilities, including SQL injection.
- Defensive Notes
- Rapidly patch public-facing applications through centralized vulnerability management.
- Restrict PowerShell use, enable ScriptBlock Logging, and apply AppLocker policies.
- Use DNS anomaly detection and restrict outbound DNS to known resolvers.
- Apply least privilege and continuously verify trust boundaries.
- Use endpoint and network telemetry to detect LOLBins, credential-theft behavior, and lateral movement.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelAPT34 is described as exfiltrating stolen data over covert DNS channels.T1059.001 · PowerShellMuddyWater and APT34 deploy PowerShell backdoors and tools for reconnaissance and lateral movement.T1071.004 · DNSAPT34 uses DNS as a covert command-and-control channel.T1078 · Valid AccountsAPT42 maintains access using stolen credentials to access email accounts and cloud storage.T1190 · Exploit Public-Facing ApplicationMuddyWater exploits vulnerabilities in public-facing applications and Handala exploits vulnerabilities on public websites.T1498 · Network Denial of ServiceHandala overwhelms target services with high-volume DDoS traffic.T1537 · Transfer Data to Cloud AccountHandala exfiltrates stolen data and publishes it on its Telegram channel.T1565.001 · Stored Data ManipulationHandala uses SQL injection against web applications to access databases.
People
Threat Actors
Afkar SystemNamed as an Iranian contractor or proxy used to carry out cyber operations.CALANQUE IONIran-attributed cyber espionage group; the article lists Charming Kitten, TA453, Mint Sandstorm, Cobalt Illusion, and SPHYNX among its aliases.Charming KittenListed in the article as an alias of APT42.Cobalt GypsyListed in the article as an alias of APT34.Cobalt IllusionListed in the article as an alias of APT42.Cotton SandstormDescribed as linked to Emennet Pasargad.CyberAv3ngersMentioned as a comparison for the operational model of Handala.EIPIdentified as the former name of Emennet Pasargad.Emennet PasargadIranian contractor or proxy; the article says it was formerly EIP and is linked to Cotton Sandstorm.HandalaPolitically motivated hacktivist group described as targeting Israeli-linked entities with DDoS, website defacement, data theft, and leaks.Hazel SandstormListed in the article as an alias of APT34.Helix KittenListed in the article as an alias of APT34.Mint SandstormListed in the article as an alias of APT42.MuddyWaterIranian MOIS-aligned espionage group; the article lists Seedworm, TEMP.Zagros, OilRig (disputed overlap), and Boggy Serpens as aliases or associated names.Najee TechnologyNamed as an Iranian contractor or proxy and associated with the Nemesis Kitten / APT35 cluster.OilRigListed as a disputed overlap with MuddyWater; separately identified as an alias of APT34.RICH IONNamed as the cluster associated with Najee Technology.SeedwormListed in the article as an alias of MuddyWater.SOLAR IONIranian cyber espionage group, potentially operating on behalf of MOIS; the article lists Helix Kitten, Hazel Sandstorm, OilRig, and Cobalt Gypsy as aliases.SPHYNXListed in the article as an alias of APT42.TA453Listed in the article as an alias of APT42.TEMP.ZagrosListed in the article as an alias of MuddyWater.
Malware
BondUpdatertactics based on the target's environment. Based on their extensive custom malware arsenal (e.g., BondUpdater, QUADAGENT), use of advanced techniques like DNS tunneling for C2, and their operational discipline,PowerKittengathering. Based on their meticulous impersonation techniques, custom malware development (e.g., PowerKitten), and persistence, APT42 is assessed as a highly sophisticated and resourceful threat actor. TheirPOWERSTATSchallenging. Notable technical observations include their heavy use of PowerShell for backdoors (e.g., POWERSTATS), DNS for command and control (C2), and the exploitation of vulnerabilities like Log4j.QUADAGENTbased on the target's environment. Based on their extensive custom malware arsenal (e.g., BondUpdater, QUADAGENT), use of advanced techniques like DNS tunneling for C2, and their operational discipline, APT34 is
Products
AppLockerHarden PowerShell Usage: Restrict scripting tool usage, implement logging (ScriptBlock Logging), and use AppLocker policies.Google Workspacecontact lists, documents, and any other sensitive information stored in compromised accounts (e.g., Google Workspace, Microsoft 365).Microsoft 365 Apps for Enterpriseand any other sensitive information stored in compromised accounts (e.g., Google Workspace, Microsoft 365).PowerShellinclude APT42, focused on espionage via social engineering and cloud compromise; MuddyWater, leveraging PowerShell and public exploits under MOIS direction; and APT34, a stealthy group employing DNS tunneling and
Tools
Countries
IranThis report outlines the evolution and current capabilities of Iran-aligned cyber threat actors, particularly in the context of heightened Iran-Israel geopolitical tensions. Iran's offensive cyber operations areIsraelcurrent capabilities of Iran-aligned cyber threat actors, particularly in the context of heightened Iran-Israel geopolitical tensions. Iran's offensive cyber operations are orchestrated primarily by the Islamic
Industries
AcademiaSectors/Verticals: APT42 primarily targets academia, human rights organizations, journalists, non-governmental organizations (NGOs), and governmental entities. Their focus is on individuals involved in research, policy,ChemicalPrimarily targets financial services, government, energy (oil & gas), telecommunications, and chemical industries. They have also been observed targeting IT companies, potentially for supply chaineCommerceTargeting is extremely broad and opportunistic. It includes government, technology, logistics, travel, eCommerce, and any commercial entity based in or vocally supporting Israel. They have claimed attacks againstEnergySectors/Verticals: Telecommunications, government (including defense and intelligence), technology, and energy sectors.Financial ServicesSectors/Verticals: Primarily targets financial services, government, energy (oil & gas), telecommunications, and chemical industries. They have also been observed targeting IT companies, potentially for supply chainGovernmentSectors/Verticals: Telecommunications, government (including defense and intelligence), technology, and energy sectors.Human rightsSectors/Verticals: APT42 primarily targets academia, human rights organizations, journalists, non-governmental organizations (NGOs), and governmental entities. Their focus is on individuals involved in research, policy,logisticsSectors/Verticals: Targeting is extremely broad and opportunistic. It includes government, technology, logistics, travel, eCommerce, and any commercial entity based in or vocally supporting Israel. They have claimedTechnologyNajee Technology (associated with Nemesis Kitten / APT35 cluster)TelecommunicationsSectors/Verticals: Telecommunications, government (including defense and intelligence), technology, and energy sectors.TravelTargeting is extremely broad and opportunistic. It includes government, technology, logistics, travel, eCommerce, and any commercial entity based in or vocally supporting Israel. They have claimed attacks