APT39

Also known as Chafer, REMIX KITTEN, COBALT HICKMAN, G0087, Radio Serpens, TA454, ITG07, Burgundy Sandstorm, CINDER ION

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a group publicly referred to as "Chafer." However, there are differences in what has been publicly reported due to the variances in how organizations track activity. APT39 primarily leverages the SEAWEED and CACHEMONEY backdoors along with a specific variant of the POWBAT backdoor. While APT39's targeting scope is global, its activities are concentrated in the Middle East. APT39 has prioritized the telecommunications sector, with additional targeting of the travel industry and IT firms that support it and the high-tech industry.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003 OS Credential Dumping T1003.001 LSASS Memory T1005 Data from Local System T1012 Query Registry T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1033 System Owner/User Discovery T1036.005 Match Legitimate Resource Name or Location T1041 Exfiltration Over C2 Channel T1046 Network Service Discovery T1053.005 Scheduled Task T1056 Input Capture T1056.001 Keylogging T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.005 Visual Basic T1059.006 Python T1059.010 AutoHotKey & AutoIT T1070.004 File Deletion T1071.001 Web Protocols T1071.004 DNS T1074.001 Local Data Staging T1078 Valid Accounts T1083 File and Directory Discovery T1090.001 Internal Proxy T1090.002 External Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1110 Brute Force T1113 Screen Capture T1115 Clipboard Data T1135 Network Share Discovery T1136.001 Local Account T1140 Deobfuscate/Decode Files or Information T1190 Exploit Public-Facing Application T1197 BITS Jobs T1204.001 Malicious Link T1204.002 Malicious File T1505.003 Web Shell T1546.010 AppInit DLLs T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification T1553.006 Code Signing Policy Modification T1555 Credentials from Password Stores T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1569.002 Service Execution T1588.002 Tool

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.