Início / Grupos de ameaça / APT39

APT39 G0087

🔔 Criar alerta

Também conhecido como: ITG07, Chafer, Remix Kitten

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

65

Técnicas

11

Malwares e ferramentas

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Desenvolvimento de recursos

T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.005 Visual Basic T1059.006 Python T1059.010 AutoHotKey & AutoIT T1197 BITS Jobs T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1136.001 Local Account T1197 BITS Jobs T1505.003 Web Shell T1546.010 AppInit DLLs T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification

Escalada de privilégios

T1053.005 Scheduled Task T1078 Valid Accounts T1546.010 AppInit DLLs T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification

Furtividade

T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1078 Valid Accounts T1140 Deobfuscate/Decode Files or Information T1197 BITS Jobs

Comprometimento de defesas

T1553.006 Code Signing Policy Modification

Acesso a credenciais

T1003 OS Credential Dumping T1003.001 LSASS Memory T1056 Input Capture T1056.001 Keylogging T1110 Brute Force T1555 Credentials from Password Stores

Descoberta

T1012 Query Registry T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1083 File and Directory Discovery T1135 Network Share Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH

Coleta

T1005 Data from Local System T1056 Input Capture T1056.001 Keylogging T1074.001 Local Data Staging T1113 Screen Capture T1115 Clipboard Data T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1071.004 DNS T1090.001 Internal Proxy T1090.002 External Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer

Exfiltração

T1041 Exfiltration Over C2 Channel

Malwares e ferramentas

ASPXSpyMalwareS0073
CadelspyMalwareS0454
MechaFlounderMalwareS0459
RemexiMalwareS0375
CrackMapExecFerramentaS0488
ftpFerramentaS0095
MimikatzFerramentaS0002
NBTscanFerramentaS0590
PsExecFerramentaS0029
pwdumpFerramentaS0006
Windows Credential EditorFerramentaS0005

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.