APT39
- ID
- G0087
- Associated names
- ITG07, Chafer, Remix Kitten
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]
Techniques used (53)
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1012 Query Registry
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1053.005 Scheduled Task
- T1056 Input Capture
- T1056.001 Keylogging
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.010 AutoHotKey & AutoIT
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1071.004 DNS
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1083 File and Directory Discovery
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1113 Screen Capture
- T1115 Clipboard Data
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1140 Deobfuscate/Decode Files or Information
- T1190 Exploit Public-Facing Application
- T1197 BITS Jobs
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1505.003 Web Shell
- T1546.010 AppInit DLLs
- T1547.001 Registry Run Keys / Startup Folder
- T1547.009 Shortcut Modification
- T1553.006 Code Signing Policy Modification
- T1555 Credentials from Password Stores
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1569.002 Service Execution
- T1588.002 Tool
Software used (11)
- S0002 Mimikatz
- S0005 Windows Credential Editor
- S0006 pwdump
- S0029 PsExec
- S0073 ASPXSpy
- S0095 ftp
- S0375 Remexi
- S0454 Cadelspy
- S0459 MechaFlounder
- S0488 CrackMapExec
- S0590 NBTscan