{
  "aliases": [
    "apt39",
    "chafer",
    "itg07"
  ],
  "attack_id": "G0087",
  "attack_name": "APT39",
  "attack_url": "https://attack.mitre.org/groups/G0087/",
  "counts": {
    "domain": 68,
    "url": 10
  },
  "first_seen": {
    "domain": {
      "0ffice36o.com": "2018-12-11",
      "100ostad.ir": "2020-12-08",
      "acrobatverify.com": "2018-09-06",
      "adobelicence.com": "2019-05-01",
      "adpolicer.org": "2019-05-01",
      "anyportals.com": "2018-09-05",
      "apigoogle-accounts.biz": "2020-05-24",
      "ccloudflare.com": "2020-12-08",
      "chembook.ir": "2020-12-08",
      "cloudipnameserver.com": "2019-05-01",
      "ctci.ir": "2020-12-08",
      "defender-update.com": "2018-08-28",
      "dnmails.gq": "2019-01-10",
      "dnrslv.gq": "2019-01-10",
      "dropboxengine.com": "2019-03-18",
      "elfdomainone.com": "2020-12-08",
      "eseses.tk": "2019-01-10",
      "facedomainpc.com": "2020-12-08",
      "facedomaintv.com": "2020-12-08",
      "fullplayersoftware.com": "2020-12-08",
      "googie.email": "2019-05-01",
      "hpserver.online": "2018-09-05",
      "idc-team.net": "2020-09-26",
      "irchemistry.com": "2020-12-08",
      "irchemistry.net": "2020-12-08",
      "j-alam.com": "2019-03-29",
      "jevxvideo.com": "2019-01-10",
      "jscript.online": "2019-05-01",
      "ktci.ir": "2020-12-08",
      "lifedomainwar.com": "2020-12-08",
      "lowconnectivity.com": "2019-05-01",
      "mailservice-verify.stream": "2019-05-01",
      "microsoftcert.xyz": "2019-01-10",
      "microsoftfixer.com": "2019-05-01",
      "milanionline.ir": "2020-12-08",
      "mobily-sa.com": "2019-05-01",
      "msn-com.dynu.net": "2019-05-01",
      "msnconnection.com": "2019-05-01",
      "mycrossweb.com": "2019-03-18",
      "nvidia-services.com": "2019-06-17",
      "offsetweb.com": "2019-03-18",
      "redjewelry.biz": "2020-05-24",
      "sabre-airlinesolutions.com": "2019-06-17",
      "sabre-css.com": "2019-06-17",
      "sadostad.com": "2020-12-08",
      "sadostad.ir": "2020-12-08",
      "saveingone.com": "2020-09-26",
      "skf-group.info": "2019-01-10",
      "softwareplayertop.com": "2020-12-08",
      "srvuptcloud.com": "2021-10-08",
      "stackwebonline.com": "2019-05-01",
      "supermario2018.com": "2019-05-01",
      "telenorco.com": "2019-05-01",
      "tleanalyser.com": "2020-09-26",
      "turkiyeburslari.tk": "2019-03-05",
      "update-microsoft.space": "2020-05-24",
      "updatenodes.site": "2019-05-01",
      "updatesecuritypatch.com": "2019-05-01",
      "verify-accounts-support.com": "2019-05-01",
      "websys-corpo.com": "2019-05-01",
      "wherisdomaintv.com": "2020-12-08",
      "whoisdomainpc.com": "2020-12-08",
      "win10-update.com": "2019-01-10",
      "win7-update.com": "2019-01-10",
      "windows-update.dynu.net": "2019-05-01",
      "xn--mgbfv9eh74d.com": "2019-03-05",
      "yjksdrl.tk": "2019-01-10",
      "ytb.services": "2019-03-05"
    },
    "url": {
      "http://134.119.217.87": "2019-03-05",
      "http://185.177.59.70": "2019-03-05",
      "http://185.206.144.174": "2019-05-01",
      "http://213.252.245.77": "2019-05-01",
      "http://213.252.245.78": "2019-05-01",
      "http://46.165.206.252": "2019-05-01",
      "http://51.77.163.86": "2019-05-01",
      "http://85.217.170.226": "2019-05-01",
      "http://94.100.21.230": "2019-05-01",
      "http://94.242.204.105": "2019-05-01"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2018-08-28",
    "latest": "2021-10-08"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "0ffice36o.com",
      "100ostad.ir",
      "acrobatverify.com",
      "adobelicence.com",
      "adpolicer.org",
      "anyportals.com",
      "apigoogle-accounts.biz",
      "ccloudflare.com",
      "chembook.ir",
      "cloudipnameserver.com",
      "ctci.ir",
      "defender-update.com",
      "dnmails.gq",
      "dnrslv.gq",
      "dropboxengine.com",
      "elfdomainone.com",
      "eseses.tk",
      "facedomainpc.com",
      "facedomaintv.com",
      "fullplayersoftware.com",
      "googie.email",
      "hpserver.online",
      "idc-team.net",
      "irchemistry.com",
      "irchemistry.net",
      "j-alam.com",
      "jevxvideo.com",
      "jscript.online",
      "ktci.ir",
      "lifedomainwar.com",
      "lowconnectivity.com",
      "mailservice-verify.stream",
      "microsoftcert.xyz",
      "microsoftfixer.com",
      "milanionline.ir",
      "mobily-sa.com",
      "msn-com.dynu.net",
      "msnconnection.com",
      "mycrossweb.com",
      "nvidia-services.com",
      "offsetweb.com",
      "redjewelry.biz",
      "sabre-airlinesolutions.com",
      "sabre-css.com",
      "sadostad.com",
      "sadostad.ir",
      "saveingone.com",
      "skf-group.info",
      "softwareplayertop.com",
      "srvuptcloud.com",
      "stackwebonline.com",
      "supermario2018.com",
      "telenorco.com",
      "tleanalyser.com",
      "turkiyeburslari.tk",
      "update-microsoft.space",
      "updatenodes.site",
      "updatesecuritypatch.com",
      "verify-accounts-support.com",
      "websys-corpo.com",
      "wherisdomaintv.com",
      "whoisdomainpc.com",
      "win10-update.com",
      "win7-update.com",
      "windows-update.dynu.net",
      "xn--mgbfv9eh74d.com",
      "yjksdrl.tk",
      "ytb.services"
    ],
    "url": [
      "http://134.119.217.87",
      "http://185.177.59.70",
      "http://185.206.144.174",
      "http://213.252.245.77",
      "http://213.252.245.78",
      "http://46.165.206.252",
      "http://51.77.163.86",
      "http://85.217.170.226",
      "http://94.100.21.230",
      "http://94.242.204.105"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "CHAFER"
  ],
  "references": [
    "https://blog.reversinglabs.com/blog/rana-android-malware",
    "https://blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_C2_list.txt",
    "https://blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_SHA1_list.txt",
    "https://blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_suspicious_domains.txt",
    "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24",
    "https://otx.alienvault.com/pulse/5d07985dd0bbe4b2a97fc1c5",
    "https://otx.alienvault.com/pulse/5f638d3debeb942fca73d6a6",
    "https://otx.alienvault.com/pulse/5fcfb6a59d838e973b829715",
    "https://securityintelligence.com/posts/observations-of-itg07-cyber-operations/",
    "https://twitter.com/ClearskySec/status/1123542294186070016",
    "https://twitter.com/ClearskySec/status/1123542295616327680",
    "https://twitter.com/ShadowChasing1/status/1442164286210535428",
    "https://twitter.com/VK_Intel/status/1074910586423648256",
    "https://twitter.com/VK_Intel/status/1093001266974916608",
    "https://twitter.com/clearskysec/status/976170940722708480",
    "https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/",
    "https://www.bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf",
    "https://www.ic3.gov/Media/News/2020/200917-2.pdf",
    "https://www.justice.gov/usao-edva/pr/iranian-hackers-indicted-stealing-data-aerospace-and-satellite-tracking-companies",
    "https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions",
    "https://www.virustotal.com/gui/file/7d5adc2b78b96996e8e5790fd224a3cc379c4721fca2671d5b8a1c03852ca66e"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "7 shared indicators",
          "kind": "infrastructure",
          "weight": 7.0
        }
      ],
      "slug": "G0049"
    },
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "G0067"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "DNSPIONAGE"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "UNCLASSIFIED"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G0010"
    },
    {
      "evidence": [
        {
          "detail": "shares Windows Credential Editor, ASPXSpy, pwdump",
          "kind": "software",
          "weight": 0.7
        }
      ],
      "slug": "G0027"
    },
    {
      "evidence": [
        {
          "detail": "shares ASPXSpy, pwdump, ftp",
          "kind": "software",
          "weight": 0.65
        }
      ],
      "slug": "G0096"
    }
  ],
  "slug": "G0087",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-10-08",
      "indicators": {
        "domain": [
          "srvuptcloud.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1442164286210535428",
        "https://www.virustotal.com/gui/file/7d5adc2b78b96996e8e5790fd224a3cc379c4721fca2671d5b8a1c03852ca66e"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2020-12-08",
      "indicators": {
        "domain": [
          "100ostad.ir",
          "ccloudflare.com",
          "chembook.ir",
          "ctci.ir",
          "elfdomainone.com",
          "facedomainpc.com",
          "facedomaintv.com",
          "fullplayersoftware.com",
          "irchemistry.com",
          "irchemistry.net",
          "ktci.ir",
          "lifedomainwar.com",
          "milanionline.ir",
          "sadostad.com",
          "sadostad.ir",
          "softwareplayertop.com",
          "wherisdomaintv.com",
          "whoisdomainpc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.reversinglabs.com/blog/rana-android-malware",
        "https://blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_SHA1_list.txt",
        "https://blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_C2_list.txt",
        "https://blog.reversinglabs.com/hubfs/Blog/rana_android_malware/IOC_suspicious_domains.txt",
        "https://www.ic3.gov/Media/News/2020/200917-2.pdf",
        "https://otx.alienvault.com/pulse/5fcfb6a59d838e973b829715"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2020-09-26",
      "indicators": {
        "domain": [
          "idc-team.net",
          "saveingone.com",
          "tleanalyser.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.justice.gov/usao-edva/pr/iranian-hackers-indicted-stealing-data-aerospace-and-satellite-tracking-companies",
        "https://otx.alienvault.com/pulse/5f638d3debeb942fca73d6a6"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2020-05-24",
      "indicators": {
        "domain": [
          "apigoogle-accounts.biz",
          "redjewelry.biz",
          "update-microsoft.space"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-06-17",
      "indicators": {
        "domain": [
          "nvidia-services.com",
          "sabre-airlinesolutions.com",
          "sabre-css.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5d07985dd0bbe4b2a97fc1c5",
        "https://securityintelligence.com/posts/observations-of-itg07-cyber-operations/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 19,
        "url": 8
      },
      "first_seen": "2019-05-01",
      "indicators": {
        "domain": [
          "adobelicence.com",
          "adpolicer.org",
          "cloudipnameserver.com",
          "googie.email",
          "jscript.online",
          "lowconnectivity.com",
          "mailservice-verify.stream",
          "microsoftfixer.com",
          "mobily-sa.com",
          "msn-com.dynu.net",
          "msnconnection.com",
          "stackwebonline.com",
          "supermario2018.com",
          "telenorco.com",
          "updatenodes.site",
          "updatesecuritypatch.com",
          "verify-accounts-support.com",
          "websys-corpo.com",
          "windows-update.dynu.net"
        ],
        "url": [
          "http://185.206.144.174",
          "http://213.252.245.77",
          "http://213.252.245.78",
          "http://46.165.206.252",
          "http://51.77.163.86",
          "http://85.217.170.226",
          "http://94.100.21.230",
          "http://94.242.204.105"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ClearskySec/status/1123542294186070016",
        "https://twitter.com/ClearskySec/status/1123542295616327680",
        "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24"
      ],
      "total": 27
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-03-29",
      "indicators": {
        "domain": [
          "j-alam.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/clearskysec/status/976170940722708480"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-03-18",
      "indicators": {
        "domain": [
          "mycrossweb.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1093001266974916608",
        "https://twitter.com/ClearskySec/status/1123542294186070016",
        "https://twitter.com/ClearskySec/status/1123542295616327680",
        "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-03-18",
      "indicators": {
        "domain": [
          "offsetweb.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1093001266974916608"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-03-18",
      "indicators": {
        "domain": [
          "dropboxengine.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1074910586423648256"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3,
        "url": 2
      },
      "first_seen": "2019-03-05",
      "indicators": {
        "domain": [
          "turkiyeburslari.tk",
          "xn--mgbfv9eh74d.com",
          "ytb.services"
        ],
        "url": [
          "http://134.119.217.87",
          "http://185.177.59.70"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2019-01-10",
      "indicators": {
        "domain": [
          "dnmails.gq",
          "dnrslv.gq",
          "eseses.tk",
          "jevxvideo.com",
          "microsoftcert.xyz",
          "skf-group.info",
          "win10-update.com",
          "yjksdrl.tk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/clearskysec/status/976170940722708480"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-01-10",
      "indicators": {
        "domain": [
          "win7-update.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-12-11",
      "indicators": {
        "domain": [
          "0ffice36o.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ClearskySec/status/1123542294186070016",
        "https://twitter.com/ClearskySec/status/1123542295616327680",
        "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-06",
      "indicators": {
        "domain": [
          "acrobatverify.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ClearskySec/status/1123542294186070016",
        "https://twitter.com/ClearskySec/status/1123542295616327680",
        "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2018-09-05",
      "indicators": {
        "domain": [
          "anyportals.com",
          "hpserver.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ClearskySec/status/1123542294186070016",
        "https://twitter.com/ClearskySec/status/1123542295616327680",
        "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-08-28",
      "indicators": {
        "domain": [
          "defender-update.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ClearskySec/status/1123542294186070016",
        "https://twitter.com/ClearskySec/status/1123542295616327680",
        "https://otx.alienvault.com/pulse/5cc9ab085bab461b1df43a24"
      ],
      "total": 1
    }
  ]
}