APT42 is an Iran-linked group that conducts surveillance and intelligence operations against journalists, academics, activists and the diaspora.

Key facts

• Aligned with Iranian intelligence priorities.
• Targets individuals seen as relevant to regime interests.
• Uses social engineering, credential theft and mobile surveillance.
• Overlaps in targeting with other Iran-linked clusters.

Why it matters

APT42 shows nation-state interest in individuals, not just institutions. Personal and organisational credential monitoring helps protect those at risk.

How DarkThreatX helps

DarkThreatX tracks threat-actor activity, leaked credentials and exposed data across the dark web so security teams can act on early warning. Run a free dark web scan or explore the platform.