APT39
APT39 is an Iranian cyber espionage group that has been active since at least 2014. They have targeted the telecommunication and travel industries to collect personal information that aligns with Iran's national priorities. [1][2]
Associated Group Descriptions
Name | Description |
---|---|
Chafer |
Activities associated with APT39 largely align with a group publicly referred to as Chafer.[1][2][3] |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .004 | Application Layer Protocol: DNS |
APT39 has used remote access tools that leverage DNS in communications with C2.[4] |
.001 | Application Layer Protocol: Web Protocols | |||
Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
APT39 has used WinRAR and 7-Zip to compress an archive stolen data. [1] |
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
APT39 has maintained persistence using the startup folder. [1] |
.009 | Boot or Logon Autostart Execution: Shortcut Modification | |||
Enterprise | T1110 | Brute Force | ||
Enterprise | T1115 | Clipboard Data |
APT39 has used tools capable of stealing contents of the clipboard.[5] |
|
Enterprise | T1059 | Command and Scripting Interpreter |
APT39 utilized custom scripts to perform internal reconnaissance. [1] |
|
.001 | PowerShell | |||
.006 | Python |
APT39 has used a command line utility and a network scanner written in python.[4] |
||
Enterprise | T1136 | .001 | Create Account: Local Account |
APT39 has created accounts on multiple compromised hosts to perform actions within the network.[4] |
Enterprise | T1555 | Credentials from Password Stores |
APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.[4] |
|
Enterprise | T1005 | Data from Local System |
APT39 has used a tool to steal files from the compromised host.[5] |
|
Enterprise | T1190 | Exploit Public-Facing Application | ||
Enterprise | T1105 | Ingress Tool Transfer | ||
Enterprise | T1056 | .001 | Input Capture: Keylogging | |
Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
APT39 has used a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.[4] |
Enterprise | T1046 | Network Service Scanning |
APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning. [1][4] |
|
Enterprise | T1135 | Network Share Discovery |
APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.[4] |
|
Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.[1][4] |
Enterprise | T1003 | OS Credential Dumping |
APT39 has used different versions of Mimikatz to obtain credentials.[4] |
|
.001 | LSASS Memory |
APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials. [1] |
||
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims. [1][5] |
.002 | Phishing: Spearphishing Link |
APT39 leveraged spearphishing emails with malicious links to initially compromise victims. [1] |
||
Enterprise | T1090 | .001 | Proxy: Internal Proxy |
APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts. [1][4] |
.002 | Proxy: External Proxy | |||
Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol |
APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions. [1][4] |
.004 | Remote Services: SSH |
APT39 used secure shell (SSH) to move laterally among their targets. [1] |
||
.002 | Remote Services: SMB/Windows Admin Shares | |||
Enterprise | T1018 | Remote System Discovery |
APT39 has used nbtscan and custom tools to discover remote systems. [1][4][5] |
|
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task | |
Enterprise | T1113 | Screen Capture |
APT39 has used a screen capture utility to take screenshots on a compromised host.[5] |
|
Enterprise | T1505 | .003 | Server Software Component: Web Shell | |
Enterprise | T1033 | System Owner/User Discovery | ||
Enterprise | T1569 | .002 | System Services: Service Execution |
APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.[4][5] |
Enterprise | T1204 | .002 | User Execution: Malicious File |
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment. [1][4][5] |
.001 | User Execution: Malicious Link |
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link. [1] |
||
Enterprise | T1078 | Valid Accounts |
APT39 has used stolen credentials to compromise Outlook Web Access (OWA). [1] |
|
Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
APT39 has communicated with C2 through files uploaded to DropBox.[4] |
Software
References
- Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
- Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.
- Higgins, K. (2019, January 30). Iran Ups its Traditional Cyber Espionage Tradecraft. Retrieved May 22, 2020.
- Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.
- Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.
- Falcone, R. (2019, March 4). New Python-Based Payload MechaFlounder Used by Chafer. Retrieved May 27, 2020.
- Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.