APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.12345
- FireEye APT39 Jan 2019
- Symantec Chafer Dec 2015
- FBI FLASH APT39 September 2020
- Dept. of Treasury Iran Sanctions September 2020
- DOJ Iran Indictments September 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1046 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1115 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.010 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.009 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.010 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1197 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1003.001 | LSASS Memory | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1021.004 | SSH | — |
| T1027.002 | Software Packing | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1046 | Network Service Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056 | Input Capture | — |
| T1056.001 | Keylogging | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1059.010 | AutoHotKey & AutoIT | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1071.004 | DNS | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1090.001 | Internal Proxy | — |
| T1090.002 | External Proxy | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1113 | Screen Capture | — |
| T1115 | Clipboard Data | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1197 | BITS Jobs | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1505.003 | Web Shell | — |
| T1546.010 | AppInit DLLs | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1547.009 | Shortcut Modification | — |
| T1553.006 | Code Signing Policy Modification | — |
| T1555 | Credentials from Password Stores | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1569.002 | Service Execution | — |
| T1588.002 | Tool | — |
别名
APT39 · Chafer · ITG07 · Remix Kitten
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。