---
title: Iranian Hackers Launch Sophisticated Espionage Campaign Against Defense Officials
description: APT42, linked to Iran's IRGC, uses social media to hack officials with TameCat malware via fake invites, targeting their families too.
canonical_url: https://codekeeper.co/ticker/iranian-apt42-hacks-officials-with-tamecat-malware
---

# Iranian Hackers Launch Sophisticated Espionage Campaign Against Defense Officials

APT42, linked to Iran's IRGC, uses social media to hack officials with TameCat malware via fake invites, targeting their families too.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 17, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Iranian state-sponsored hacking group APT42, linked to the Islamic Revolutionary Guard Corps, is conducting an elaborate espionage campaign targeting senior defense and government officials. The hackers spend weeks building relationships with victims through social media before sending fake conference invitations that either steal credentials or install TameCat malware. The sophisticated PowerShell backdoor communicates through Telegram and Discord, allowing hackers to remotely execute commands and steal sensitive data. APT42 even targets victims' family members to increase pressure and expand their attack surface. Israel's National Digital Agency warns the campaign uses legitimate cloud services mixed with attacker infrastructure to maintain long-term access to high-value targets. **Source:** [Security Week](https://www.securityweek.com/iranian-hackers-target-defense-and-government-officials-in-ongoing-campaign/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Firanian-apt42-hacks-officials-with-tamecat-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

["Bad Epoll" Kernel Flaw Gives Attackers Root Access on Linux and Android Aug 12, 2026](https://codekeeper.co/ticker/linux-bad-epoll-vulnerability-root-access)

[Cyberattacks Brevo Supply Chain Attack Hit Up to 100,000 Websites Sep 21, 2026](https://codekeeper.co/ticker/brevo-supply-chain-attack-malicious-code)

[Lincoln Cathedral and Leisure Centres Hit by Cyber Attack on CRM Provider Aug 11, 2026](https://codekeeper.co/ticker/beacon-crm-data-breach-lincoln-cathedral)

[Supply Chain Attack Hits 32 Red Hat NPM Packages Aug 12, 2026](https://codekeeper.co/ticker/red-hat-npm-hack-malware-attack)