APT39

🔴 High
Also known as: APT 39, APT39, Burgundy Sandstorm, CINDER ION, COBALT HICKMAN, Cadelle, Chafer, Cobalt Hickman, G0087, ITG07, REMIX KITTEN, Radio Serpens, Remix Kitten, TA454

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS. FireEye APT39 Jan 2019 Symantec Chafer Dec 2015 FBI FLASH APT39 September 2020 Dept. of Treasury Iran Sanctions September 2020 DOJ Iran Indictments September 2020

🌍 Country Iran
📅 Activity 2019 — 2019
⚡ Risk Level High
🧭 ATT&CK G0087
2019
2019

Associated Operations

2017 2018 2018 Autumn 2018-02 Bitdefender researchers have found attacks conducted by this actor in the Middle East region Chafer appears to have been undeterred by its exposure in 2015 and continued to be very active during 2017 Jordan Saudi Arabia Sectors targeted included airlines Spying on Iran-based foreign diplomatic entities Symantec has also found evidence of attacks against one African airline and attempts to compromise an international travel reservations firm. This new secondary payload is Python-based and compiled into executable form using the PyInstaller utility. This is the first instance where Unit 42 has identified a Python-based payload used by these operators. We’ve also identified code overlap with OilRig’s Clayside VBScript but at this time track Chafer and OilRig as separate threat groups. We have named this payload MechaFlounder for tracking purposes. Throughout the autumn of 2018 we analyzed a long-standing (and still active at that time) cyberespionage campaign that was primarily targeting foreign diplomatic entities based in Iran. The attackers were using an improved version of Remexi in what the victimology suggests might be a domestic cyberespionage operation. Turkish Government Targeting aircraft services and Turkey. and attacking nine new target organizations in the region. The group hit organizations in Israel and document management software. Outside of the Middle East as well as different hacking tools and a custom built backdoor. dating back to 2018. The campaigns were based on several tools engineering consultancies https://securelist.com/chafer-used-remexi-malware/89538/ https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/ https://www.bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions including “living off the land” tools payroll services rolling out new infrastructure software and IT services companies serving the air and sea transport sectors telecoms services the United Arab Emirates using seven new tools which makes attribution difficult

Introduction

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS. FireEye APT39 Jan 2019 Symantec Chafer Dec 2015 FBI FLASH APT39 September 2020 Dept. of Treasury Iran Sanctions September 2020 DOJ Iran Indictments September 2020

Activities and Tactics

Country of Origin: 🇮🇷 Iran

Risk Level: High

First Seen: 2019

Last Activity: 2019

Notable Campaigns

  • 2017
  • 2018
  • 2018 Autumn
  • 2018-02
  • Bitdefender researchers have found attacks conducted by this actor in the Middle East region
  • Chafer appears to have been undeterred by its exposure in 2015 and continued to be very active during 2017
  • Jordan
  • Saudi Arabia
  • Sectors targeted included airlines
  • Spying on Iran-based foreign diplomatic entities
  • Symantec has also found evidence of attacks against one African airline and attempts to compromise an international travel reservations firm.
  • This new secondary payload is Python-based and compiled into executable form using the PyInstaller utility. This is the first instance where Unit 42 has identified a Python-based payload used by these operators. We’ve also identified code overlap with OilRig’s Clayside VBScript but at this time track Chafer and OilRig as separate threat groups. We have named this payload MechaFlounder for tracking purposes.
  • Throughout the autumn of 2018 we analyzed a long-standing (and still active at that time) cyberespionage campaign that was primarily targeting foreign diplomatic entities based in Iran. The attackers were using an improved version of Remexi in what the victimology suggests might be a domestic cyberespionage operation.
  • Turkish Government Targeting
  • aircraft services
  • and Turkey.
  • and attacking nine new target organizations in the region. The group hit organizations in Israel
  • and document management software. Outside of the Middle East
  • as well as different hacking tools and a custom built backdoor.
  • dating back to 2018. The campaigns were based on several tools
  • engineering consultancies
  • https://securelist.com/chafer-used-remexi-malware/89538/
  • https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/
  • https://www.bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf
  • https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions
  • including “living off the land” tools
  • payroll services
  • rolling out new infrastructure
  • software and IT services companies serving the air and sea transport sectors
  • telecoms services
  • the United Arab Emirates
  • using seven new tools
  • which makes attribution difficult

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • Backdoor.Oldrea
  • ASPXSpy:
  • Antak:
  • EternalBlue:
  • HTTPTunnel:
  • Living off the Land:
  • MechaFlounder:
  • Metasploit:
  • Mimikatz:
  • Non-sucking Service Manager:
  • OilRig:
  • POWBAT:
  • Plink:
  • Rana:
  • Remcom:
  • Remexi:
  • SEAWEED:
  • SMB hacking tools:
  • SafetyKatz:
  • UltraVNC:
  • Windows Credentials Editor:
  • nbtscan:
  • pwdump:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [6] Crowdstrike GTR2020 Mar 2020 Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. [7] Dept. of Treasury Iran Sanctions September 2020 Dept. of Treasury. (2020, September 17). Treasury Sanctions Cyber Actors Backed by Iranian Intelligence. Retrieved December 10, 2020. [8] DOJ Iran Indictments September 2020 DOJ. (2020, September 17). Department of Justice and Partner Departments and Agencies Conduct Coordinated Actions to Disrupt and Deter Iranian Malicious Cyber Activities Targeting the United States and the Broader International Community. Retrieved December 10, 2020. [9] FBI FLASH APT39 September 2020 FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020. [10] FireEye APT39 Jan 2019 Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. [11] Dark Reading APT39 JAN 2019 Higgins, K. (2019, January 30). Iran Ups its Traditional Cyber Espionage Tradecraft. Retrieved May 22, 2020. [12] Symantec Chafer Dec 2015 Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.