Home › Threat Actors › APT39
← All Threat Actors
Nation-State medium Iran

APT39

Conducted by Iran's Ministry of Intelligence and Security (MOIS) via front company Rana Intelligence Computing. US Treasury OFAC sanctioned APT39, Rana, and 45 individuals employed there (Sept 17, 2020); FBI Boston Division led the underlying investigation. MITRE ATT&CK G0087. · Espionage focused on bulk personal-data theft for tracking/monitoring individuals of interest to Iran — distinct from influence-ops or disruptive-attack Iranian clusters

Reports 1
Active Since At least 2014
Last Reported 25 Sept 2026
Sectors Targeted telecommunications, travel-hospitality, government, technology

Tactics, Techniques & Procedures (TTPs)

  • Spearphishing delivering a POWBAT variant distinct from APT34's; lookalike domains; web shells (ANTAK, ASPXSpy) on vulnerable public-facing servers
  • Credential stuffing/reuse against externally exposed Outlook Web Access
  • Custom backdoors SEAWEED and CACHEMONEY
  • Mimikatz, Ncrack, Windows Credential Editor, ProcDump, pwdump, CrackMapExec for credential access
  • REDTRIP/PINKTRIP/BLUETRIP SOCKS5 proxies; RDP/SSH/PsExec/RemCom for lateral movement

Known Targets

Telecommunications (priority); travel, hospitality, IT firms supporting travel/telecom, high-tech, academia, government (secondary)Saudi Arabia, Iraq, Egypt, Turkey, UAE, Qatar, South Korea, US15 US travel-sector companies plus foreign airlines/governments (per the 2020 Treasury action)

Analyst Notes

No publicly confirmed named victim of APT39 exists — FireEye stated this explicitly in 2019 and nothing since has changed it. No new OFAC designation or FBI action specific to APT39 has followed the 2020 sanctions. CISA's AA26-097A (Iranian ICS exploitation of US water/energy infrastructure) is attributed to the distinct group CyberAv3ngers, not APT39. Cadelspy/Remexi appear in some secondary sources as associated names but may be malware families rather than group aliases — treat with caution.

Also Known As

Chafer (Symantec)Remix Kitten (CrowdStrike)ITG07 (IBM X-Force)

MITRE ATT&CK Techniques

T1566.001 Phishing: Spearphishing Attachment T1190 Exploit Public-Facing Application T1078 Valid Accounts T1110 Brute Force T1003 OS Credential Dumping T1113 Screen Capture

Intelligence Reports

Commentary telecommunicationstravel-hospitality

APT39 Was Never About Sabotage. That's Exactly Why It's Easy to Forget About

Iran's APT39/Chafer hacks people, not headlines — bulk telecom and travel data theft in service of tracking individuals, run through a sanctioned front company. Six years after the US named it, no new victim has ever been publicly confirmed.

25 Sept 2026 · 6 min read