Automation · API / MCP 中文

Group profile · G0087

APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

ATT&CK G0087 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2019

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.12345

  1. FireEye APT39 Jan 2019
  2. Symantec Chafer Dec 2015
  3. FBI FLASH APT39 September 2020
  4. Dept. of Treasury Iran Sanctions September 2020
  5. DOJ Iran Indictments September 2020

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asAPT39— → …100src_mitre_attck_enterprise
also_known_asITG07— → …100src_mitre_attck_enterprise
also_known_asChafer— → …100src_mitre_attck_enterprise
also_known_asRemix Kitten— → …100src_mitre_attck_enterprise
uses_techniquetech_t10462019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1090.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11402019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1056.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11152019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10032019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0062019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0102019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0092019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11352019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1569.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0132019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10332019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1102.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1505.0032019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0102019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t15552019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11132019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0042019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10592019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10122019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11102019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11972019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1136.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1090.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782019 → …100src_mitre_attck_enterprise
uses_techniquetech_t10562019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0022019 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052019 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0042019 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1003OS Credential Dumping—
T1003.001LSASS Memory—
T1005Data from Local System—
T1012Query Registry—
T1018Remote System Discovery—
T1021.001Remote Desktop Protocol—
T1021.002SMB/Windows Admin Shares—
T1021.004SSH—
T1027.002Software Packing—
T1027.013Encrypted/Encoded File—
T1033System Owner/User Discovery—
T1036.005Match Legitimate Resource Name or Location—
T1041Exfiltration Over C2 Channel—
T1046Network Service Discovery—
T1053.005Scheduled Task—
T1056Input Capture—
T1056.001Keylogging—
T1059Command and Scripting Interpreter—
T1059.001PowerShell—
T1059.005Visual Basic—
T1059.006Python—
T1059.010AutoHotKey & AutoIT—
T1070.004File Deletion—
T1071.001Web Protocols—
T1071.004DNS—
T1074.001Local Data Staging—
T1078Valid Accounts—
T1083File and Directory Discovery—
T1090.001Internal Proxy—
T1090.002External Proxy—
T1102.002Bidirectional Communication—
T1105Ingress Tool Transfer—
T1110Brute Force—
T1113Screen Capture—
T1115Clipboard Data—
T1135Network Share Discovery—
T1136.001Local Account—
T1140Deobfuscate/Decode Files or Information—
T1190Exploit Public-Facing Application—
T1197BITS Jobs—
T1204.001Malicious Link—
T1204.002Malicious File—
T1505.003Web Shell—
T1546.010AppInit DLLs—
T1547.001Registry Run Keys / Startup Folder—
T1547.009Shortcut Modification—
T1553.006Code Signing Policy Modification—
T1555Credentials from Password Stores—
T1560.001Archive via Utility—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1569.002Service Execution—
T1588.002Tool—

Aliases

APT39 · Chafer · ITG07 · Remix Kitten

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections