G0087: APT39

G0087: APT39 describes [APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Cita...

Executive priority

G0087: APT39 is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0087: APT39 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether G0087: APT39 appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques53 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1046	Network Service Discovery	APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.[1]CitationBitDefender Chafer May 2020
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	APT39 has maintained persistence using the startup folder.[1]
Enterprise	T1090.002	External ProxySub-technique	APT39 has used various tools to proxy C2 communications.CitationBitDefender Chafer May 2020
Enterprise	T1140	Deobfuscate/Decode Files or Information	APT39 has used malware to decrypt encrypted CAB files.[3]
Enterprise	T1056.001	KeyloggingSub-technique	APT39 has used tools for capturing keystrokes.CitationSymantec Chafer February 2018[3]
Enterprise	T1005	Data from Local System	APT39 has used various tools to steal files from the compromised host.CitationSymantec Chafer February 2018[3]
Enterprise	T1059.001	PowerShellSub-technique	APT39 has used PowerShell to execute malicious code.CitationBitDefender Chafer May 2020CitationSymantec Chafer February 2018
Enterprise	T1115	Clipboard Data	APT39 has used tools capable of stealing contents of the clipboard.CitationSymantec Chafer February 2018
Enterprise	T1003	OS Credential Dumping	APT39 has used different versions of Mimikatz to obtain credentials.CitationBitDefender Chafer May 2020
Enterprise	T1553.006	Code Signing Policy ModificationSub-technique	APT39 has used malware to turn off the `RequireSigned` feature which ensures only signed DLLs can be run on Windows.[3]
Enterprise	T1546.010	AppInit DLLsSub-technique	APT39 has used malware to set `LoadAppInit_DLLs` in the Registry key `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows` in order to establish persistence.[3]
Enterprise	T1547.009	Shortcut ModificationSub-technique	APT39 has modified LNK shortcuts.[1]
Enterprise	T1135	Network Share Discovery	APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.CitationBitDefender Chafer May 2020
Enterprise	T1569.002	Service ExecutionSub-technique	APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.CitationBitDefender Chafer May 2020CitationSymantec Chafer February 2018
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	APT39 has used malware to drop encrypted CAB files.[3]
Enterprise	T1588.002	ToolSub-technique	APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.CitationBitDefender Chafer May 2020CitationIBM ITG07 June 2019
Enterprise	T1021.001	Remote Desktop ProtocolSub-technique	APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.[1]CitationBitDefender Chafer May 2020
Enterprise	T1033	System Owner/User Discovery	APT39 used Remexi to collect usernames from the system.[2]
Enterprise	T1027.002	Software PackingSub-technique	APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.[1]CitationBitDefender Chafer May 2020
Enterprise	T1041	Exfiltration Over C2 Channel	APT39 has exfiltrated stolen victim data through C2 communications.[3]
Enterprise	T1204.002	Malicious FileSub-technique	APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.[1]CitationBitDefender Chafer May 2020CitationSymantec Chafer February 2018[3]
Enterprise	T1053.005	Scheduled TaskSub-technique	APT39 has created scheduled tasks for persistence.[1]CitationBitDefender Chafer May 2020[3]
Enterprise	T1070.004	File DeletionSub-technique	APT39 has used malware to delete files after they are deployed on a compromised host.[3]
Enterprise	T1102.002	Bidirectional CommunicationSub-technique	APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.CitationBitDefender Chafer May 2020
Enterprise	T1560.001	Archive via UtilitySub-technique	APT39 has used WinRAR and 7-Zip to compress an archive stolen data.[1]
Enterprise	T1505.003	Web ShellSub-technique	APT39 has installed ANTAK and ASPXSPY web shells.[1]
Enterprise	T1105	Ingress Tool Transfer	APT39 has downloaded tools to compromised hosts.CitationSymantec Chafer February 2018[3]
Enterprise	T1059.010	AutoHotKey & AutoITSub-technique	APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.[3]
Enterprise	T1204.001	Malicious LinkSub-technique	APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.[1][3]
Enterprise	T1555	Credentials from Password Stores	APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.CitationBitDefender Chafer May 2020
Enterprise	T1113	Screen Capture	APT39 has used a screen capture utility to take screenshots on a compromised host.CitationSymantec Chafer February 2018[3]
Enterprise	T1003.001	LSASS MemorySub-technique	APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.[1]
Enterprise	T1018	Remote System Discovery	APT39 has used NBTscan and custom tools to discover remote systems.[1]CitationBitDefender Chafer May 2020CitationSymantec Chafer February 2018
Enterprise	T1071.004	DNSSub-technique	APT39 has used remote access tools that leverage DNS in communications with C2.CitationBitDefender Chafer May 2020
Enterprise	T1059	Command and Scripting Interpreter	APT39 has utilized custom scripts to perform internal reconnaissance.[1][3]
Enterprise	T1074.001	Local Data StagingSub-technique	APT39 has utilized tools to aggregate data prior to exfiltration.[3]
Enterprise	T1083	File and Directory Discovery	APT39 has used tools with the ability to search for files on a compromised host.[3]
Enterprise	T1012	Query Registry	APT39 has used various strains of malware to query the Registry.[3]
Enterprise	T1110	Brute Force	APT39 has used Ncrack to reveal credentials.[1]
Enterprise	T1197	BITS Jobs	APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.[3]
Enterprise	T1136.001	Local AccountSub-technique	APT39 has created accounts on multiple compromised hosts to perform actions within the network.CitationBitDefender Chafer May 2020
Enterprise	T1059.006	PythonSub-technique	APT39 has used a command line utility and a network scanner written in python.CitationBitDefender Chafer May 2020[3]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.CitationBitDefender Chafer May 2020[3]
Enterprise	T1071.001	Web ProtocolsSub-technique	APT39 has used HTTP in communications with C2.CitationBitDefender Chafer May 2020[3]
Enterprise	T1090.001	Internal ProxySub-technique	APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.[1]CitationBitDefender Chafer May 2020
Enterprise	T1078	Valid Accounts	APT39 has used stolen credentials to compromise Outlook Web Access (OWA).[1]
Enterprise	T1056	Input Capture	APT39 has utilized tools to capture mouse movements.[3]
Enterprise	T1566.002	Spearphishing LinkSub-technique	APT39 leveraged spearphishing emails with malicious links to initially compromise victims.[1][3]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.[1]CitationSymantec Chafer February 2018[3]
Enterprise	T1021.002	SMB/Windows Admin SharesSub-technique	APT39 has used SMB for lateral movement.CitationSymantec Chafer February 2018
Enterprise	T1190	Exploit Public-Facing Application	APT39 has used SQL injection for initial compromise.CitationSymantec Chafer February 2018
Enterprise	T1059.005	Visual BasicSub-technique	APT39 has utilized malicious VBS scripts in malware.[3]
Enterprise	T1021.004	SSHSub-technique	APT39 used secure shell (SSH) to move laterally among their targets.[1]

Associated objects

Groups, software, and campaigns

S0590: NBTscan

NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.[1][2][3][4]

WindowsLinuxmacOS

S0459: MechaFlounder

MechaFlounder is a python-based remote access tool (RAT) that has been used by APT39. The payload uses a combination of actor developed code and code snippets freely available online in development communities.[1]

Windows

S0375: Remexi

Remexi is a Windows-based Trojan that was developed in the C programming language.[1]

Windows

S0488: CrackMapExec

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]

Windows

S0006: pwdump

pwdump is a credential dumper. [1]

Windows

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows

S0005: Windows Credential Editor

Windows Credential Editor is a password dumping tool. [1]

Windows

S0454: Cadelspy

Cadelspy is a backdoor that has been used by APT39.[1]

Windows

S0029: PsExec

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]

Windows

S0073: ASPXSpy

ASPXSpy is a Web shell. It has been modified by Threat Group-3390 actors to create the ASPXTool version. [1]

Windows

S0095: ftp

ftp is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data.[1][2]

LinuxWindowsmacOS

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 3.2
Created: Feb 19, 2019, 16:01 UTC (UTC+00:00)
Modified: Jul 31, 2026, 18:47 UTC (UTC+00:00)
Raw hash: 31d17f0ca9f1e456...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	3.2	Jul 31, 2026, 18:47 UTC (UTC+00:00)	Current bundle	`31d17f0ca9f1…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	3.2	Jul 31, 2026, 18:47 UTC (UTC+00:00)	Older bundle	`31d17f0ca9f1…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	3.2	Apr 11, 2024, 02:59 UTC (UTC+00:00)	Older bundle	`cdee270d3cad…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
FireEye APT39 Jan 2019
Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
Open source URL
[2]
Symantec Chafer Dec 2015
Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.
Open source URL
[3]
FBI FLASH APT39 September 2020
FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
Open source URL
[4]
Dept. of Treasury Iran Sanctions September 2020
Dept. of Treasury. (2020, September 17). Treasury Sanctions Cyber Actors Backed by Iranian Intelligence. Retrieved December 10, 2020.
Open source URL
[5]
DOJ Iran Indictments September 2020
DOJ. (2020, September 17). Department of Justice and Partner Departments and Agencies Conduct Coordinated Actions to Disrupt and Deter Iranian Malicious Cyber Activities Targeting the United States and the Broader International Community. Retrieved December 10, 2020.
Open source URL
[6]
Dark Reading APT39 JAN 2019
Higgins, K. (2019, January 30). Iran Ups its Traditional Cyber Espionage Tradecraft. Retrieved May 22, 2020.
Open source URL
[7]
APT39
(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)
[8]
Chafer
Activities associated with APT39 largely align with a group publicly referred to as Chafer.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: Dark Reading APT39 JAN 2019)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)
[9]
Crowdstrike GTR2020 Mar 2020
Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.
Open source URL
[10]
ITG07
(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)
[11]
Remix Kitten
(Citation: Crowdstrike GTR2020 Mar 2020)
[12]
mitre-attackG0087
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use

Security context for executives and security teams

Executive priority

Technical view

Likely telemetry

Detection direction

Mitigation priorities

APT39

How security teams should use this page

Techniques used

Groups, software, and campaigns

All related ATT&CK context

Object version and sync metadata

Mirrored ATT&CK source object

External references and citations