Threat actor profile
A source-linked view of reported activity, targets and related automated campaign clusters.
Background and history
APT42 is an identifier found in current source reporting. Threat-research teams may use different names for overlapping activity, and the available evidence does not always support a permanent or universally agreed group boundary.
This profile is built from the reports collected by The Cornish Geek rather than a fixed attribution claim. Review the supporting sources, dates, observed behaviour and target context before using the label in an operational or executive decision.
Known aliases
APT42
Google Threat Intelligence Group · 24 Jul 2026
Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…
