According to the directorate, APT42, a group linked to Iran’s IRGC, has been sending highly credible-looking emails from fake domains containing malicious links.