Loading story…
Google-owned Mandiant reported that APT39, an Iranian state-aligned cyber-espionage group, continues to focus on stealing personal information that can support surveillance, targeting, and broader intelligence collection. The group has been linked to operations against individuals and organizations where identity data, travel records, communications, and other sensitive personal details can be used to track persons of interest and support follow-on intrusion activity.
The reporting highlights APT39 as a persistent espionage actor rather than a financially motivated threat, with operations designed to collect data that advances Iranian intelligence objectives. For defenders, the activity underscores the need to monitor for credential theft, unauthorized access to repositories holding personally identifiable information, and intrusion patterns associated with long-term intelligence gathering against high-value users and institutions.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Google Cloud's Mandiant published a report profiling APT39 as an Iranian cyber-espionage group focused on collecting personal information. The reference does not provide earlier dated events, so the publication itself is the only extractable event.
FireEye published research describing APT39 as an Iranian cyber-espionage group focused on collecting personal information. The report established public reporting on the group's targeting and objectives years before the later Mandiant analysis.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury sanctioned Iranian cyber group **APT39**, its front company **Rana Intelligence Computing Company**, and 45 associated individuals for supporting Iran’s Ministry of Intelligence and Security (**MOIS**) in a long-running intrusion and surveillance campaign. U.S. officials said the operation targeted Iranian dissidents, journalists, former officials, NGOs, academic institutions, foreign governments, intelligence services, airlines, and travel-sector companies across more than 30 countries, including roughly 15 U.S. companies, as part of Tehran’s intelligence and repression efforts. At the same time, the FBI, in coordination with DHS/CISA and Treasury, published a **TLP:WHITE** alert detailing eight malware sets tied to Rana and APT39, also tracked as **Chafer**, **Cadelspy**, **Remexi**, and **ITG07**. The advisory described VBS, AutoIt, Python, BITS-based, Firefox-themed, and Android malware families, along with persistence methods, command-and-control behavior, indicators of compromise, and **YARA** rules to help defenders detect activity. One Android implant, `Optimizer.apk`, was reported to collect device data, record audio, take photos, and exfiltrate AES-encrypted data over HTTP POST via `saveingone.com`.
Aug 15, 2026
Google-owned Mandiant detailed how **APT41**, a China-linked threat group also known as **Double Dragon**, continues to blend state-aligned espionage with financially motivated intrusions. The reporting describes a long-running operation in which the group targets organizations across multiple sectors and geographies while using a broad toolkit of malware, compromised infrastructure, and hands-on-keyboard tradecraft to steal data, maintain persistence, and support intelligence collection. Mandiant said APT41 stands out because it operates at the intersection of **nation-state espionage** and **cybercrime**, shifting between strategic targeting and profit-driven activity without separating the two missions. The group has been tied to intrusions affecting enterprises worldwide and remains notable for its adaptability, operational scale, and ability to exploit trusted environments to advance both theft and surveillance objectives.
Jul 12, 2026
Leaked internal documents and previously exposed operator recordings have provided an unusually detailed view into the operations of **Charming Kitten**—also tracked as **APT35**, **Phosphorus**, and **Mint Sandstorm**—an Iranian state-linked cyber-espionage group reportedly affiliated with the IRGC. The leaked cache published in late 2025 described formal command structures, campaign workflows, target lists, and attack playbooks, while earlier video footage reportedly captured operators conducting intrusions and stealing data from email accounts after accidentally exposing recordings on an internet-accessible server. Together, the materials depict a mature intelligence operation using phishing, credential harvesting, web shells, OSINT, mass scanning, and exploitation of vulnerabilities in products including `ConnectWise`, `Ivanti Connect Secure`, `PHP-CGI`, `Telerik UI`, `Confluence`, `GitLab`, `WordPress` plugins, and `Jenkins`. The exposed records indicate that APT35 conducted both targeted and opportunistic campaigns across the Middle East, including activity affecting government bodies, telecom systems, legal entities, and internet-facing infrastructure in Israel, Jordan, Afghanistan, Saudi Arabia, Turkey, and the United Arab Emirates. Reported theft included **74 GB** of data tied to Jordan-linked targets and thousands of emails from Afghan ministries. Separate infrastructure analysis in 2026 also found domains and rogue mail subdomains likely prepared for phishing against Egyptian shipping and marine services companies, with researchers linking the setup to Iran-aligned activity consistent with APT35 and suggesting possible compromise of legitimate DNS or cPanel configurations to support the operation.
Aug 15, 2026