APT42

Tag for APT42 actor and cluster coverage

SpearSpecter — Iranian-linked APT42 uses WhatsApp lures and PowerShell backdoor

Nov 16, 2025

—

by

Elles De Yeager

in Digital Espionage & Intelligence

INDA analysis shows APT42’s SpearSpecter uses WhatsApp lures and a modular PowerShell backdoor that targets officials and family members; detection steps and IOCs are included in the report.