APT42 is a threat actor attributed to IR, also known as UNC788, Yellow Garuda, CALANQUE. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does APT42 exploit?

APT42 is known to exploit 12 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

APT42

Also known as: UNC788, Yellow Garuda, CALANQUE, Educated Manticore, ITG-018, CharmingCypress, SpearSpecter, Mint Sandstorm, TA453, Charming Kitten, Newscaster, Parastoo, iKittens, Group 83, NewsBeef, G0058, PHOSPHORUS, APT35, CHARMING KITTEN, Newscaster Team, Magic Hound, G0059, Phosphorus, TunnelVision, COBALT MIRAGE, Agent Serpens, COBALT ILLUSION, TA455, ITG18

IRCyber Espionage

Exploited CVEs

Overview

Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government.

Exploited Vulnerabilities

CVE ID	Action
CVE-2021-31207	View Details