← All actors Recent activity

APT39 G0087

CHAFER · apt39 · itg07

Indicators
78
Source reports
21
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20182021

Overview 78 indicators

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.

domain68G0087-domain.txt
url10G0087.json

Techniques 53 ATT&CK

Open in ATT&CK Navigator → or download the layer (53 techniques, layer 4.5)

Software 11

Principal sources 21 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 78 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 1 domain5 yrs ago

    twitter.com/ShadowChasing1/status/14421642862105354… · virustotal.com/gui/file/7d5adc2b78b96996e8e5790fd224a3…

    srvuptcloud.com

  2. 18 domain6 yrs ago

    blog.reversinglabs.com/blog/rana-android-malware · blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_SHA… · blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_C2_… · blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_sus… · ic3.gov/Media/News/2020/200917-2.pdf · otx.alienvault.com/pulse/5fcfb6a59d838e973b829715

    100ostad.ir
    ccloudflare.com
    chembook.ir
    ctci.ir
    elfdomainone.com
    facedomainpc.com
    facedomaintv.com
    fullplayersoftware.com
    irchemistry.com
    irchemistry.net
    ktci.ir
    lifedomainwar.com
    milanionline.ir
    sadostad.com
    sadostad.ir
    softwareplayertop.com
    wherisdomaintv.com
    whoisdomainpc.com

  3. 3 domain6 yrs ago

    justice.gov/usao-edva/pr/iranian-hackers-indicted-s… · otx.alienvault.com/pulse/5f638d3debeb942fca73d6a6

    idc-team.net
    saveingone.com
    tleanalyser.com

  4. 3 domain6 yrs ago

    bitdefender.com/files/News/CaseStudies/study/332/Bitdef…

    apigoogle-accounts.biz
    redjewelry.biz
    update-microsoft.space

  5. 3 domain7 yrs ago

    otx.alienvault.com/pulse/5d07985dd0bbe4b2a97fc1c5 · securityintelligence.com/posts/observations-of-itg07-cyber-opera…

    nvidia-services.com
    sabre-airlinesolutions.com
    sabre-css.com

  6. 19 domain, 8 url7 yrs ago

    twitter.com/ClearskySec/status/1123542294186070016 · twitter.com/ClearskySec/status/1123542295616327680 · otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24

    domainadobelicence.com
    domainadpolicer.org
    domaincloudipnameserver.com
    domaingoogie.email
    domainjscript.online
    domainlowconnectivity.com
    domainmailservice-verify.stream
    domainmicrosoftfixer.com
    domainmobily-sa.com
    domainmsn-com.dynu.net
    domainmsnconnection.com
    domainstackwebonline.com
    domainsupermario2018.com
    domaintelenorco.com
    domainupdatenodes.site
    domainupdatesecuritypatch.com
    domainverify-accounts-support.com
    domainwebsys-corpo.com
    domainwindows-update.dynu.net
    urlhttp://185.206.144.174
    urlhttp://213.252.245.77
    urlhttp://213.252.245.78
    urlhttp://46.165.206.252
    urlhttp://51.77.163.86
    urlhttp://85.217.170.226
    urlhttp://94.100.21.230
    urlhttp://94.242.204.105

  7. 1 domain7 yrs ago

    twitter.com/clearskysec/status/976170940722708480

    j-alam.com

  8. 1 domain7 yrs ago

    twitter.com/VK_Intel/status/1093001266974916608 · twitter.com/ClearskySec/status/1123542294186070016 · twitter.com/ClearskySec/status/1123542295616327680 · otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24

    mycrossweb.com

  9. 1 domain7 yrs ago

    twitter.com/VK_Intel/status/1093001266974916608

    offsetweb.com

  10. 1 domain7 yrs ago

    twitter.com/VK_Intel/status/1074910586423648256

    dropboxengine.com

  11. 3 domain, 2 url7 yrs ago

    unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-…

    domainturkiyeburslari.tk
    domainxn--mgbfv9eh74d.com
    domainytb.services
    urlhttp://134.119.217.87
    urlhttp://185.177.59.70

  12. 8 domain7 yrs ago

    twitter.com/clearskysec/status/976170940722708480

    dnmails.gq
    dnrslv.gq
    eseses.tk
    jevxvideo.com
    microsoftcert.xyz
    skf-group.info
    win10-update.com
    yjksdrl.tk

  13. 1 domain7 yrs ago

    symantec.com/blogs/threat-intelligence/chafer-latest…

    win7-update.com

  14. 1 domain8 yrs ago

    twitter.com/ClearskySec/status/1123542294186070016 · twitter.com/ClearskySec/status/1123542295616327680 · otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24

    0ffice36o.com

  15. 1 domain8 yrs ago

    twitter.com/ClearskySec/status/1123542294186070016 · twitter.com/ClearskySec/status/1123542295616327680 · otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24

    acrobatverify.com

  16. 2 domain8 yrs ago

    twitter.com/ClearskySec/status/1123542294186070016 · twitter.com/ClearskySec/status/1123542295616327680 · otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24

    anyportals.com
    hpserver.online

  17. 1 domain8 yrs ago

    twitter.com/ClearskySec/status/1123542294186070016 · twitter.com/ClearskySec/status/1123542295616327680 · otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24

    defender-update.com

Further reading 29