MITRE ATT&CKgroup
G0087 APT39
- Domain
- enterprise
- Aliases
- ITG07, Chafer, Remix Kitten
- Version
- 3.2
- Created
- 2019-02-19
Description
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.
Related
Uses · MITRE ATT&CK (64)
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.010 AutoHotKey & AutoIT sub-technique
- T1553.006 Code Signing Policy Modification sub-technique
- S0590 NBTscan software (tool)
- T1588.002 Tool sub-technique
- S0488 CrackMapExec software (tool)
- S0459 MechaFlounder software (malware)
- S0454 Cadelspy software (malware)
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1090.001 Internal Proxy sub-technique
- T1090.002 External Proxy sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1074.001 Local Data Staging sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1059.006 Python sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.001 LSASS Memory sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.004 SSH sub-technique
- T1056.001 Keylogging sub-technique
- T1555 Credentials from Password Stores technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
References
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf Crowdstrike GTR2020 Mar 2020
- https://home.treasury.gov/news/press-releases/sm1127 Dept. of Treasury Iran Sanctions September 2020
- https://www.justice.gov/opa/pr/department-justice-and-partner-departments-and-agencies-conduct-coordinated-actions-disrupt DOJ Iran Indictments September 2020
- https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf FBI FLASH APT39 September 2020
- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html FireEye APT39 Jan 2019
- https://www.darkreading.com/attacks-breaches/iran-ups-its-traditional-cyber-espionage-tradecraft/d/d-id/1333764 Dark Reading APT39 JAN 2019
- https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets Symantec Chafer Dec 2015