{
  "name": "Iranian backed group steps up phishing campaigns against Israel, U.S.",
  "slug": "iranian-backed-group-steps-up-phishing-campaigns-against-israel-us",
  "description": "An Iranian government-backed threat group known as APT42 has significantly intensified its phishing campaigns targeting high-profile individuals in Israel and the United States over the past six months. The group, associated with Iran's Islamic Revolutionary Guard Corps, has focused on current and former government officials, political campaigns, diplomats, think tanks, NGOs, and academic institutions involved in foreign policy discussions. APT42's activities demonstrate a concerted effort to rapidly shift its operational priorities in line with Iran's political and military objectives.",
  "published": "2024-08-26T10:43:41+00:00",
  "created_at": "2024-08-26T10:43:41+00:00",
  "modified_at": "2024-08-26T11:06:15+00:00",
  "created_at_opencti": "2024-08-26T10:43:41+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-08-26",
    "credential-theft",
    "dwp",
    "election targeting",
    "gcollection",
    "iran",
    "lcollection",
    "phishing",
    "social engineering",
    "ycollection"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "91.107.150.184"
      },
      {
        "id": "",
        "name": "49.13.194.118"
      },
      {
        "id": "",
        "name": "http://smaaaal.cfd/Wp59tqKU"
      },
      {
        "id": "",
        "name": "http://short-ion-per.live/08EFNZ1"
      },
      {
        "id": "",
        "name": "http://sharedrive.webredirect.org/Khn/shoaGzA/cGNt/dMPaV/kvvhK"
      },
      {
        "id": "",
        "name": "http://s3api.shop/api/"
      },
      {
        "id": "",
        "name": "http://panel-short-check.live/ZZqt3LYD"
      },
      {
        "id": "",
        "name": "http://panel-short-check.live/PhyfkFQX"
      },
      {
        "id": "",
        "name": "http://click-choose-figured.cfd/Gallery/Ref/FSaEM5gG"
      },
      {
        "id": "",
        "name": "http://click-choose-figured.cfd/Gallery/Password"
      },
      {
        "id": "",
        "name": "http://checking-paneling.live/aliasauthG/autoref/vNSX6c2m"
      },
      {
        "id": "",
        "name": "http://checking-paneling.live/aliasauthG/Password"
      },
      {
        "id": "",
        "name": "http://check-pabnel-status.live/Lcollection/Ref/F53OQQkE"
      },
      {
        "id": "",
        "name": "http://check-pabnel-status.live/Lcollection/Password"
      },
      {
        "id": "",
        "name": "http://check-pabnel-status.live/Gcollection/Ref/CkliPwaM"
      },
      {
        "id": "",
        "name": "http://check-pabnel-status.live/Gcollection/Password"
      },
      {
        "id": "",
        "name": "visioneditor.loseyourip.com"
      },
      {
        "id": "",
        "name": "sharedrive.webredirect.org"
      },
      {
        "id": "",
        "name": "smaaaal.cfd"
      },
      {
        "id": "",
        "name": "short-ion-per.live"
      },
      {
        "id": "",
        "name": "s3api.shop"
      },
      {
        "id": "",
        "name": "click-choose-figured.cfd"
      },
      {
        "id": "",
        "name": "checking-paneling.live"
      },
      {
        "id": "",
        "name": "brookings.email"
      },
      {
        "id": "",
        "name": "accredit-navigation.online"
      },
      {
        "id": "",
        "name": "understandingthewar.org"
      },
      {
        "id": "",
        "name": "panel-short-check.live"
      },
      {
        "id": "",
        "name": "check-pabnel-status.live"
      },
      {
        "id": "",
        "name": "f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060"
      },
      {
        "id": "",
        "name": "c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32"
      },
      {
        "id": "",
        "name": "bc2597ce09987022ff0498c6710a9b51a1a47ed8082ac044be2838b384157527"
      },
      {
        "id": "",
        "name": "baac058ddfc96c8aea8c0057077505f0ad3ff20311d999886fed549924404849"
      },
      {
        "id": "",
        "name": "89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c"
      },
      {
        "id": "",
        "name": "82ae2eb470a5a16ca39ec84b387294eaa3ae82e5ada4b252470c1281e1f31c0a"
      },
      {
        "id": "",
        "name": "0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60"
      },
      {
        "id": "",
        "name": "c3486133783379e13ed37c45dc6645cbee4c1c6e62e7988722931eef99c8eaf3"
      },
      {
        "id": "",
        "name": "4ac088bf25d153ec2b9402377695b15a28019dc8087d98bd34e10fed3424125f"
      },
      {
        "id": "",
        "name": "33a61ff123713da26f45b399a9828e29ad25fbda7e8994c954d714375ef92156"
      }
    ],
    "malware": [
      {
        "id": "d3bc4729-f951-4851-ba4a-f01d0e0c51c6",
        "name": "DWP",
        "slug": "dwp"
      },
      {
        "id": "51113b18-e078-4b7a-917e-b37f3e994b3a",
        "name": "YCollection",
        "slug": "ycollection"
      },
      {
        "id": "916dceeb-ccf6-44b4-bd13-fa693254fbb0",
        "name": "GCollection",
        "slug": "gcollection"
      },
      {
        "id": "4d14429b-c58a-4267-9565-188119933420",
        "name": "LCollection",
        "slug": "lcollection"
      }
    ],
    "intrusion_sets": [
      {
        "id": "8336079d-62bc-4f52-badb-912fcb9e0f04",
        "name": "APT42",
        "slug": "apt42"
      }
    ],
    "attack_patterns": [
      {
        "id": "4b7fe10d-2daa-4f42-b6c2-b5186960c756",
        "name": "T1610"
      },
      {
        "id": "ab179192-1c1a-4b7d-9792-b608a9459b71",
        "name": "T1591"
      },
      {
        "id": "4bbdf41c-817c-448a-9513-aaea6bfbe8b4",
        "name": "T1568"
      },
      {
        "id": "b3ad0214-589b-48ea-b042-93d73e1e0e4b",
        "name": "T1086"
      },
      {
        "id": "2969e5a7-1049-4df8-b1ba-8a0675de6b94",
        "name": "T1589"
      },
      {
        "id": "5e3b3612-8bf8-46e1-943e-b4c1524bef11",
        "name": "T1587"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "5bab4974-1fc2-4144-b093-28ebcb8767dc",
        "name": "T1114"
      },
      {
        "id": "f48eade0-2f45-4ff7-aa61-8ba887887f81",
        "name": "T1123"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "ed82bdd1-d346-48d1-98de-36a9a0a96489",
        "name": "T1040"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Israel"
      },
      {
        "id": "",
        "name": "United States of America"
      }
    ]
  },
  "external_refs": [
    "https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/",
    "https://otx.alienvault.com/pulse/66cc787d3fb1bcb51eae3894"
  ]
}