Executive Summary
APT39 — tracked by Symantec as Chafer and by CrowdStrike as Remix Kitten — is a cyber-espionage operation run through Iran’s Ministry of Intelligence and Security (MOIS), active since at least 2014 per MITRE’s ATT&CK entry (G0087). In September 2020, the US Treasury sanctioned APT39, a front company called Rana Intelligence Computing, and 45 individuals employed there, while the FBI’s Boston Division published a public advisory detailing the operation’s malware and reach. That 2020 action remains the most significant public document on this group’s structure, and nothing comparable has followed. There is no publicly confirmed named victim of APT39 — FireEye said so explicitly in its original 2019 analysis, and nothing since has changed that. It’s a useful group to sit with precisely because it doesn’t generate incident headlines the way espionage actors chasing intellectual property or disruptive sabotage do.
A Different Kind of Mission
FireEye’s 2019 analysis drew a distinction worth preserving: APT39’s focus on bulk personal data — travel itineraries, telecommunications customer records — sets it apart from Iranian clusters oriented toward influence operations or destructive attacks. The mission here reads as tracking and monitoring individuals Iran has an interest in, not classic intelligence collection against institutions or financial theft. That’s a narrower, more personal form of espionage, and it explains the sector focus: telecommunications companies and travel-adjacent businesses hold exactly the kind of records — who flew where, who called whom — that support monitoring specific people rather than stealing trade secrets or disrupting infrastructure.
The Rana Front
The September 2020 OFAC action is the clearest window into how this actually ran. Rana Intelligence Computing operated as a ostensibly ordinary technology company that functioned as a front for MOIS cyber operations. The Treasury sanctions named 45 individuals employed there alongside the company and APT39 itself, and the FBI’s parallel advisory — built on the underlying investigation out of its Boston Division — detailed eight distinct malware families the operation used. Vendor naming for the group split along familiar lines: FireEye/Mandiant settled on APT39, Symantec calls it Chafer, CrowdStrike uses Remix Kitten, and IBM X-Force tracks it as ITG07. Some secondary sources also mention Cadelspy and Remexi in connection with the group — these appear in reporting as malware family names rather than confirmed alternate group aliases, and the relationship between those names and the group identity is muddled enough across sources that it shouldn’t be stated with confidence either way.
Toolkit and Access
The group’s malware set, per Mandiant’s reporting, includes custom backdoors SEAWEED and CACHEMONEY, along with a variant of POWBAT distinct from the one used by the separate Iranian cluster APT34, plus web shells tracked as ANTAK and ASPXSpy. For credential access and privilege escalation, the toolkit includes Mimikatz, Ncrack, Windows Credential Editor, ProcDump, pwdump, and CrackMapExec, with BLUETORCH and NBTscan used for network reconnaissance. Lateral movement and proxying relied on RDP, SSH, PsExec, RemCom, and three SOCKS5 proxy tools tracked as REDTRIP, PINKTRIP, and BLUETRIP, with WinRAR and 7-Zip used to stage data before exfiltration. Initial access methods include spearphishing delivering POWBAT, lookalike domains, web shells planted on vulnerable public-facing servers, and credential stuffing or reuse against externally exposed Outlook Web Access deployments. The 2020 Treasury action specifically described Rana as having hacked 15 US travel-sector companies, in addition to foreign airlines and government targets.
Geography and Targets
MITRE’s listing and Mandiant’s original reporting both describe a targeting pattern concentrated in telecommunications as the priority sector, with travel, hospitality, IT firms that support the travel and telecom industries, high-tech companies, academia, and government agencies as secondary targets. Geographically, the footprint runs through the Middle East — Saudi Arabia, Iraq, Egypt, Turkey, the UAE, and Qatar all appear in reporting — along with South Korea and the United States.
Where Things Stand
No new OFAC designation or FBI action specifically naming APT39 has followed the September 2020 sanctions — the handful of 2026-dated records that reference the group (procurement-exclusion database entries, sanctions-list metadata showing a “last change” timestamp) are administrative artifacts of the existing designation, not new enforcement actions, and shouldn’t be reported as fresh developments. MITRE’s G0087 page shows a July 2026 last-modified date, but the substantive content still rests on 2019–2020 reporting — that’s consistent with a routine page review, not evidence of newly tracked activity. 2026 threat-landscape roundups (a Halcyon update, a Rescana UAE-focused report, a Push Security note referencing credential harvesting via spoofed airline and telecom domains across 30-plus countries) mention APT39/Chafer as part of the broader active Iran-nexus landscape, but none of these attach a specific, dated, named incident to the group — they read as vendor commentary situating the group within a general threat picture rather than fresh primary reporting. It’s also worth explicitly separating this group from CISA’s April 2026 advisory (AA26-097A) on Iranian exploitation of industrial control systems in US water and energy utilities — that advisory attributes the activity to CyberAv3ngers, a distinct IRGC-linked group, not APT39.
What This Means
APT39 is a reminder that not every active state-nexus actor produces a steady drumbeat of named incidents — some operate specifically to avoid being noticed by the people whose data they’re collecting, which by design limits what ever surfaces publicly. The absence of a confirmed named victim since the group was first profiled isn’t evidence it’s gone quiet; it may just be evidence the model is working as intended. Organizations in telecom and travel with any nexus to individuals of interest to Iran should weigh that against the comparatively thin recent public reporting, rather than reading “no news” as “no risk.”