NEW: Group Profiler — instant APT intel lookup. Try it →

APT39

G0087 Iran MITRE ATT&CK →

Also known as: ITG07 · Chafer · Remix Kitten

Overview

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

Naming & attribution

APT39 is tracked under 4 names across the industry. It uses 53 documented ATT&CK techniques — more than 84% of the 174 groups tracked here. Activity attributed since at least 2014.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
NameFirst reported by
ITG07FBI
ChaferHawley et al
Remix KittenCrowdstrike
APT39Hawley et al

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

  • T1059.010 AutoHotKey & AutoIT — used by 1 of 174 groups
  • T1546.010 AppInit DLLs — used by 1 of 174 groups
  • T1553.006 Code Signing Policy Modification — used by 2 of 174 groups
  • T1056 Input Capture — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

  • OilRig Iran — 30 shared techniques (30% overlap)
  • APT41 China — 30 shared techniques (29% overlap)
  • FIN13 — 24 shared techniques (29% overlap)
  • menuPass China — 22 shared techniques (29% overlap)
  • Fox Kitten Iran — 21 shared techniques (29% overlap)
  • Dragonfly Russia — 24 shared techniques (28% overlap)

Capabilities

  • Exploitation of public-facing / client applications — ATT&CK T1190
  • Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 53 techniques across 13 tactics

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Tools & malware (11)

NBTscan · MechaFlounder · Remexi · CrackMapExec · pwdump · Mimikatz · Windows Credential Editor · Cadelspy · PsExec · ASPXSpy · ftp

Reporting (3)

Need the matrix overlay, mind-map, or technique-flow view? Open the interactive Group Profiler in a browser with JavaScript enabled.