APT39

APT39 is an Iranian state-sponsored threat actor. Known aliases in the provided content include Burgundy Sandstorm, Cadelle, Chafer, ITG07, and Remix Kitten. The group has used spearphishing emails with malicious attachments for initial compromise. Reported tradecraft includes use of custom scripts for internal reconnaissance; NBTscan and custom tools to discover remote systems; PowerShell to execute malicious code; multiple malware strains to query the Windows Registry; modified and customized publicly available tools such as PLINK and Mimikatz; SmartFTP Password Decryptor to decrypt FTP passwords; malware and tools to steal files from compromised hosts; and tools to aggregate data prior to exfiltration. APT39 has proxied command-and-control communications using various tools, including malware disguised as Mozilla Firefox and a tool named mfevtpse.exe designed to mimic the legitimate McAfee file mfevtps.exe. The group has communicated with command-and-control through files uploaded to and downloaded from Dropbox, exfiltrated stolen victim data through command-and-control channels, and used malware to drop encrypted CAB files and later decrypt encrypted CAB files. For persistence, APT39 has used the Startup folder and created scheduled tasks. The group has also used RDP for lateral movement and persistence, and in some cases used the rdpwinst tool to manage multiple sessions. The content also notes APT39 as one of the highest-impact state-sponsored risk vectors in the Middle East and describes it within Iran’s broader state-sponsored cyber ecosystem.