{
  "id": "apt39",
  "name": "APT39",
  "aliases": [
    "ITG07",
    "Chafer",
    "Remix Kitten"
  ],
  "domain": "cyber",
  "country": "IRN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IRN"
  ],
  "summary": "APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Iran's Ministry of Intelligence and Security (MOIS), via front company Rana Intelligence Computing",
      "src": [
        "mitre-g0087"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2014,
      "src": [
        "mitre-g0087"
      ],
      "conf": "medium",
      "note": "At least 2014"
    },
    {
      "k": "attack_id",
      "v": "G0087",
      "src": [
        "mitre-g0087"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.",
      "src": [
        "mitre-g0087"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 53,
      "src": [
        "mitre-g0087"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ASPXSpy, Cadelspy, CrackMapExec, ftp, MechaFlounder, Mimikatz, NBTscan, PsExec, pwdump, Remexi, Windows Credential Editor",
      "src": [
        "mitre-g0087"
      ],
      "conf": "high",
      "note": "11 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0087)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/apt39.html",
  "sources": {
    "mitre-g0087": {
      "title": "APT39, Group G0087",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0087/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}