APT39

State-sponsored cyber threat groupTrackedPending verification

Also known as: ITG07, Chafer, Remix Kitten

CyberIRN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeState-sponsored cyber threat group

Alternative designationsITG07, Chafer, Remix Kitten

ProliferationOrigin country only

Active since2014At least 2014Med^[1]

MITRE ATT&CK IDG0087High^[1]

Capabilities

ATT&CK techniques used53ATT&CK v20.1High^[1]

Malware and toolsASPXSpy, Cadelspy, CrackMapExec, ftp, MechaFlounder, Mimikatz, NBTscan, PsExec, pwdump, Remexi, Windows Credential Editor11 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorIran's Ministry of Intelligence and Security (MOIS), via front company Rana Intelligence ComputingHigh^[1]

TargetsAPT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.Med^[1]

Notes

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Iran

Sources

APT39, Group G0087, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0087)