← Back to Actors
APT39
APT39ITG07ChaferRemix Kitten
[APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI ...
53
Techniques
53
Covered
0
Gaps
100%
Coverage
Coverage53/53
COVERED (53)
T1003OS Credential Dumping114 det.T1003.001LSASS Memory111 det.T1005Data from Local System51 det.T1012Query Registry25 det.T1018Remote System Discovery52 det.T1021.001Remote Desktop Protocol55 det.T1021.002SMB/Windows Admin Shares74 det.T1021.004SSH38 det.T1027.002Software Packing2 det.T1027.013Encrypted/Encoded File8 det.T1033System Owner/User Discovery62 det.T1036.005Match Legitimate Resource Name or Location49 det.T1041Exfiltration Over C2 Channel32 det.T1046Network Service Discovery53 det.T1053.005Scheduled Task100 det.T1056Input Capture7 det.T1056.001Keylogging4 det.T1059Command and Scripting Interpreter552 det.T1059.001PowerShell384 det.T1059.005Visual Basic71 det.T1059.006Python55 det.T1059.010AutoHotKey & AutoIT1 det.T1070.004File Deletion46 det.T1071.001Web Protocols83 det.T1071.004DNS37 det.T1074.001Local Data Staging10 det.T1078Valid Accounts320 det.T1083File and Directory Discovery49 det.T1090.001Internal Proxy10 det.T1090.002External Proxy9 det.T1102.002Bidirectional Communication17 det.T1105Ingress Tool Transfer199 det.T1110Brute Force100 det.T1113Screen Capture19 det.T1115Clipboard Data16 det.T1135Network Share Discovery20 det.T1136.001Local Account46 det.T1140Deobfuscate/Decode Files or Information59 det.T1190Exploit Public-Facing Application240 det.T1197BITS Jobs25 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1505.003Web Shell70 det.T1546.010AppInit DLLs2 det.T1547.001Registry Run Keys / Startup Folder53 det.T1547.009Shortcut Modification6 det.T1553.006Code Signing Policy Modification4 det.T1555Credentials from Password Stores43 det.T1560.001Archive via Utility27 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1569.002Service Execution65 det.T1588.002Tool13 det.