APT39 - G0087

Created: 2019-02-19T16:01:38.585Z

Modified: 2022-09-02T18:03:29.024Z

Contributors:

Aliases

APT39,ITG07,Chafer,Remix Kitten

Description

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)

Techniques Used

APT39 has modified and used customized versions of publicly-available tools like PLINK and

Mimikatz.(Citation: BitDefender Chafer May 2020)(Citation: IBM ITG07 June 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.010|AppInit DLLs|

APT39 has used malware to set

APT39 has used malware to decrypt encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS|T1553.006|Code Signing Policy Modification|

APT39 has used malware to turn off the

APT39 has used malware to delete files after they are deployed on a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT39 has used malware to drop encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|