APT39
MISPUnknown
IR
Unknown
[APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)
Techniques Used (53)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1003 | OS Credential Dumping | - |
| T1003.001 | LSASS Memory | - |
| T1005 | Data from Local System | - |
| T1012 | Query Registry | - |
| T1018 | Remote System Discovery | - |
| T1021.001 | Remote Desktop Protocol | - |
| T1021.002 | SMB/Windows Admin Shares | - |
| T1021.004 | SSH | - |
| T1027.002 | Software Packing | - |
| T1027.013 | Encrypted/Encoded File | - |
| T1033 | System Owner/User Discovery | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1041 | Exfiltration Over C2 Channel | - |
| T1046 | Network Service Discovery | - |
| T1053.005 | Scheduled Task | - |
References (10)
- fireeye.com - Apt39 Iranian Cyber Espionage Group Focused On Personal Information
- symantec.com - Chafer Latest Attacks Reveal Heightened Ambitions
- unit42.paloaltonetworks.com - New Python Based Payload Mechaflounder Used By Chafer
- securelist.com - 89538
- symantec.com - Iran Based Attackers Use Back Door Threats Spy Middle Eastern Targets
- attack.mitre.org - G0087
- go.crowdstrike.com - Report2020CrowdStrikeGlobalThreatReport.pdf
- secureworks.com - Cobalt Hickman
- unit42.paloaltonetworks.com - Radioserpens
- securityintelligence.com - Observations Of Itg07 Cyber Operations
Aliases (1136)
Related Malware (11)
Metadata
| ID: | 206 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 04:00 |