FORENSIA

THREAT_ACTOR · G0087

APT39

Also known as: APT39, ITG07, Chafer, Remix Kitten

Profile

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

MITRE ATT&CK ↗

Techniques

53 ATT&CK techniques attributed to this actor.

T1003 OS Credential DumpingT1003.001 LSASS MemoryT1005 Data from Local SystemT1012 Query RegistryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSHT1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1033 System Owner/User DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1041 Exfiltration Over C2 ChannelT1046 Network Service DiscoveryT1053.005 Scheduled TaskT1056 Input CaptureT1056.001 KeyloggingT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.005 Visual BasicT1059.006 PythonT1059.010 AutoHotKey & AutoITT1070.004 File DeletionT1071.001 Web ProtocolsT1071.004 DNST1074.001 Local Data StagingT1078 Valid AccountsT1083 File and Directory DiscoveryT1090.001 Internal ProxyT1090.002 External ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1110 Brute ForceT1113 Screen CaptureT1115 Clipboard DataT1135 Network Share DiscoveryT1136.001 Local AccountT1140 Deobfuscate/Decode Files or InformationT1190 Exploit Public-Facing ApplicationT1197 BITS JobsT1204.001 Malicious LinkT1204.002 Malicious FileT1505.003 Web ShellT1546.010 AppInit DLLsT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut ModificationT1553.006 Code Signing Policy ModificationT1555 Credentials from Password StoresT1560.001 Archive via UtilityT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1569.002 Service ExecutionT1588.002 Tool

Software

11 malware/tools attributed to this actor.

MimikatzWindows Credential EditorpwdumpPsExecASPXSpyftpRemexiCadelspyMechaFlounderCrackMapExecNBTscan

Related corpus activity

10,444 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to APT39.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-2492cve—852
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2020-22658cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2025-23304cve—852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2022-47945cve—851
cve-2025-34117cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,444.