Trusted Design

APT39

アクターID: G0087

· MITRE Pageへのリンク

脅威アクターの詳細

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)

脅威アクターの別名・別称

APT39
ITG07
Chafer
Remix Kitten

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1156 - Malicious Shell Modification
• T1557 - Adversary-in-the-Middle
• T1596.003 - Digital Certificates
• T1597.002 - Purchase Technical Data
• T1491.002 - External Defacement
• T1195.001 - Compromise Software Dependencies and Development Tools
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1087.002 - Domain Account
• T1543.003 - Windows Service
• T1165 - Startup Items
• T1598.003 - Spearphishing Link
• T1566.001 - Spearphishing Attachment
• T1007 - System Service Discovery
• T1499.002 - Service Exhaustion Flood
• T1584.003 - Virtual Private Server
• T1059.010 - AutoHotKey & AutoIT
• T1140 - Deobfuscate/Decode Files or Information
• T1562 - Impair Defenses
• T1050 - New Service
• T1032 - Standard Cryptographic Protocol
• T1021 - Remote Services
• T1555.003 - Credentials from Web Browsers
• T1583.004 - Server
• T1546.005 - Trap
• T1547.011 - Plist Modification
• T1055.013 - Process Doppelgänging
• T1219.001 - IDE Tunneling
• T1087.004 - Cloud Account
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1097 - Pass the Ticket
• T1157 - Dylib Hijacking
• T1599 - Network Boundary Bridging
• T1547.002 - Authentication Package
• T1570 - Lateral Tool Transfer
• T1001.003 - Protocol or Service Impersonation
• T1027.004 - Compile After Delivery
• T1564.007 - VBA Stomping
• T1070.009 - Clear Persistence
• T1537 - Transfer Data to Cloud Account
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1134 - Access Token Manipulation
• T1209 - Time Providers
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1027.018 - Invisible Unicode
• T1027.007 - Dynamic API Resolution
• T1569.002 - Service Execution

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1157)
• CVE-2015-5749 (T1560.001)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2015-7262 (T1157)
• CVE-2015-0932 (T1140)
• CVE-2010-3081 (T1209)
• CVE-2017-16929 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-68645 (T1027.018)
• CVE-2013-3906 (T1055.013)
• CVE-2013-6282 (T1219.001)
• CVE-2025-55182 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-13928 (T1157)
• CVE-2025-24893 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2016-2343 (T1562)
• CVE-2016-6532 (T1097)
• CVE-2014-7247 (T1027.018)
• CVE-2013-5990 (T1027.018)
• CVE-2014-4114 (T1027.007)
• CVE-2015-1770 (T1027.007)
• CVE-2015-2545 (T1027.007)
• CVE-2017-0199 (T1027.007)
• CVE-2012-0158 (T1027.007)
• CVE-2014-6352 (T1027.007)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1219.001)
• CVE-2013-0640 (T1087.002)
• CVE-2011-0611 (T1140)
• CVE-2015-0071 (T1027.018)
• CVE-2015-7755 (T1165)
• CVE-2015-8286 (T1562)
• CVE-2015-8287 (T1140)
• CVE-2010-1553 (T1027.018)
• CVE-2014-1761 (T1140)
• CVE-2015-2853 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2013-7331 (T1569.002)
• CVE-2009-3129 (T1027.018)
• CVE-2014-4113 (T1027.007)
• CVE-2015-2360 (T1027.007)
• CVE-2014-4148 (T1027.007)
• CVE-2014-6332 (T1027.007)
• CVE-2010-0806 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2012-1856 (T1027.007)
• CVE-2015-7645 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-3113 (T1097)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2015-2502 (T1027.007)
• CVE-2014-6271 (T1027.018)
• CVE-2013-2094 (T1027.018)
• CVE-2016-1010 (T1027.018)
• CVE-2016-1019 (T1157)
• CVE-2016-0984 (T1027.018)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1641 (T1027.018)
• CVE-2015-1701 (T1027.007)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-3628 (T1157)
• CVE-2016-1287 (T1140)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2016-9494 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2012-0056 (T1157)
• CVE-2015-0336 (T1027.018)
• CVE-2014-3153 (T1157)
• CVE-2014-4322 (T1157)
• CVE-2015-3636 (T1157)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2014-8439 (T1209)
• CVE-2013-2551 (T1027.018)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1219.001)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2015-5560 (T1219.001)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2010-1297 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2010-2883 (T1209)
• CVE-2013-0634 (T1097)
• CVE-2013-2595 (T1157)
• CVE-2015-4902 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2017-0143 (T1027.007)
• CVE-2025-55183 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2014-3393 (T1219.001)
• CVE-2015-1427 (T1555.003)
• CVE-2015-3456 (T1157)
• CVE-2016-2342 (T1209)
• CVE-2012-0611 (T1027.018)
• CVE-2015-5897 (T1157)
• CVE-2008-1436 (T1027.007)
• CVE-2012-4969 (T1027.007)
• CVE-2014-0322 (T1027.007)
• CVE-2015-2546 (T1027.018)
• CVE-2015-3785 (T1219.001)
• CVE-2016-1990 (T1157)
• CVE-2016-1991 (T1219.001)
• CVE-2015-2852 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2015-6022 (T1027.018)
• CVE-2017-0263 (T1027.018)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2012-1258 (T1209)
• CVE-2011-3544 (T1027.018)
• CVE-2017-17215 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2015-0057 (T1027.007)
• CVE-2015-1761 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2014-2273 (T1219.001)
• CVE-2014-3897 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-4117 (T1219.001)
• CVE-2017-0001 (T1027.018)
• CVE-2025-66478 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2026-20127 (T1027.018)
• CVE-2015-7808 (T1157)
• CVE-2015-6034 (T1157)
• CVE-2016-9496 (T1027.018)
• CVE-2012-4681 (T1027.018)
• CVE-2010-0738 (T1157)
• CVE-2012-6422 (T1157)
• CVE-2025-13927 (T1157)
• CVE-2026-1102 (T1157)
• CVE-2014-8361 (T1556.005)
• CVE-2017-7255 (T1134)
• CVE-2017-12149 (T1027.018)
• CVE-2015-8562 (T1027.018)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る