Home / Threat actors / APT39

APT39 G0087

🔔 Create alert

Also known as: ITG07, Chafer, Remix Kitten

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

65

Techniques

11

Malware and tools

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1588.002 Tool

Initial Access

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.005 Visual Basic T1059.006 Python T1059.010 AutoHotKey & AutoIT T1197 BITS Jobs T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1136.001 Local Account T1197 BITS Jobs T1505.003 Web Shell T1546.010 AppInit DLLs T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification

Privilege Escalation

T1053.005 Scheduled Task T1078 Valid Accounts T1546.010 AppInit DLLs T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification

Stealth

T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1078 Valid Accounts T1140 Deobfuscate/Decode Files or Information T1197 BITS Jobs

Defense Impairment

T1553.006 Code Signing Policy Modification

Credential Access

T1003 OS Credential Dumping T1003.001 LSASS Memory T1056 Input Capture T1056.001 Keylogging T1110 Brute Force T1555 Credentials from Password Stores

Discovery

T1012 Query Registry T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1083 File and Directory Discovery T1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH

Collection

T1005 Data from Local System T1056 Input Capture T1056.001 Keylogging T1074.001 Local Data Staging T1113 Screen Capture T1115 Clipboard Data T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1071.004 DNS T1090.001 Internal Proxy T1090.002 External Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer

Exfiltration

T1041 Exfiltration Over C2 Channel

Malware and tools

ASPXSpyMalwareS0073
CadelspyMalwareS0454
MechaFlounderMalwareS0459
RemexiMalwareS0375
CrackMapExecToolS0488
ftpToolS0095
MimikatzToolS0002
NBTscanToolS0590
PsExecToolS0029
pwdumpToolS0006
Windows Credential EditorToolS0005

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.