APT39
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.
- ATT&CK ID
- G0087
- Origin
- Iran
- Techniques
- 39
- Tools
- 11
Also tracked as ITG07 · Chafer · Remix Kitten
Techniques
Resource Development
Initial Access
Valid AccountsExploit Public-Facing ApplicationPhishing
Execution
Scheduled Task/JobCommand and Scripting InterpreterBITS JobsUser ExecutionSystem Services
Persistence
Scheduled Task/JobValid AccountsCreate AccountBITS JobsServer Software ComponentEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobValid AccountsEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsDeobfuscate/Decode Files or InformationBITS Jobs
Defense Impairment
Credential Access
OS Credential DumpingInput CaptureBrute ForceCredentials from Password Stores
Discovery
Query RegistryRemote System DiscoverySystem Owner/User DiscoveryNetwork Service DiscoveryFile and Directory DiscoveryNetwork Share Discovery
Lateral Movement
Collection
Data from Local SystemInput CaptureData StagedScreen CaptureClipboard DataArchive Collected Data
Command and Control
Application Layer ProtocolProxyWeb ServiceIngress Tool Transfer
Exfiltration
Software
ASPXSpy · Cadelspy · CrackMapExec · MechaFlounder · Mimikatz · NBTscan · PsExec · Remexi · Windows Credential Editor · ftp · pwdump