Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT39 · Unknown · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT39

  • Chafer
  • REMIX KITTEN
  • COBALT HICKMAN
  • G0087
  • Radio Serpens
  • TA454
  • ITG07
  • Burgundy Sandstorm

MITRE G0087 ↗

APT39 — ATT&CK roseAP

attack rose · 53 techniques across 13 tactics

Analyst brief

misp-galaxy + mitre-attack

APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a group publicly referred to as "Chafer." However, there are differences in what has been publicly reported due to the variances in how organizations track activity. APT39 primarily leverages the SEAWEED and CACHEMONEY backdoors along with a specific variant of the POWBAT backdoor. While APT39's targeting scope is global, its activities are concentrated in the Middle East. APT39 has prioritized the telecommunications sector, with additional targeting of the travel industry and IT firms that support it and the high-tech industry.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

53 techniques · 13 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    3 techniques

  3. Execution

    9 techniques

  4. Persistence

    4 techniques

  5. Privilege escalation

    1 technique

  6. Stealth

    7 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    4 techniques

  9. Discovery

    6 techniques

  10. Lateral movement

    3 techniques

  11. Collection

    7 techniques

  12. Command and control

    6 techniques

  13. Exfiltration

    1 technique

select a technique

Arsenal

4 malware · 7 tools
Malware
Malware · 4ATT&CK
MechaFlounderS0459 ↗
RemexiS0375 ↗
CadelspyS0454 ↗
ASPXSpyS0073 ↗
Tools
Tools · 7ATT&CK
NBTscanS0590 ↗
CrackMapExecS0488 ↗
pwdumpS0006 ↗
MimikatzS0002 ↗
Windows Credential EditorS0005 ↗
PsExecS0029 ↗
ftpS0095 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2019Chafer used Remexi malware to spy on Iran-based foreign diplomatic entitiesKaspersky ↗

Take it with you

keyless · no signup

References

16 sources
  1. 1.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espio…
  2. 2.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal…
  3. 3.unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer
  4. 4.securelist.com/chafer-used-remexi-malware/89538
  5. 5.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threa…
  6. 6.attack.mitre.org/groups/G0087
  7. 7.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
  8. 8.secureworks.com/research/threat-profiles/cobalt-hickman
  9. 9.unit42.paloaltonetworks.com/atoms/radioserpens
  10. 10.securityintelligence.com/posts/observations-of-itg07-cyber-operations
  11. +6 more in the JSON record

Track APT39 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.