APT39

Overview

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 53 techniques across 13 tactics

Tools & malware (11)

NBTscan · MechaFlounder · Remexi · CrackMapExec · pwdump · Mimikatz · Windows Credential Editor · Cadelspy · PsExec · ASPXSpy · ftp

Reporting (3)

• Treasury Sanctions Cyber Actors Backed by Iranian Intelligence — Dept. of Treasury
• Department of Justice and Partner Departments and Agencies Conduct Coordinated Actions to Disrupt and Deter Iranian Malicious Cyber Activities Targeting the United States and the Broader International Community — DOJ
• Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07 — FBI