Quick links
Press Enter to search, Esc to close
Threat group profile
The US Treasury, FBI and Department of Justice attributed APT39, also called Chafer, to Iran's Ministry of Intelligence and Security (MOIS), working through the front company Rana Intelligence Computing Company, in September 2020.
In short
The US Treasury, FBI and Department of Justice attributed APT39, also called Chafer, to Iran's Ministry of Intelligence and Security (MOIS), working through the front company Rana Intelligence Computing Company, in September 2020. The US sanctioned the company and 45 people.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT39 | Name used by MITRE ATT&CK (G0087), the FBI alert, the US Treasury and the US Department of Justice[1, 2, 3, 4] |
| Advanced Persistent Threat 39 | Full form of the name in the Treasury press release and the OFAC list entry[3, 5] |
| Chafer | MITRE Associated Groups list, which says APT39 activity largely aligns with a group publicly called Chafer; also named in the FBI alert, DOJ release and OFAC entry[1, 2, 4, 5] |
| ITG07 | MITRE Associated Groups list; also named in the FBI alert, DOJ release and OFAC entry[1, 2, 4, 5] |
| Remix Kitten | MITRE Associated Groups list[1] |
| Cadelspy | Listed as a name for the actor in the FBI alert, DOJ release and OFAC entry; MITRE lists it as a separate backdoor (S0454)[2, 4, 5, 8] |
| Remexi | Listed as a name for the actor in the FBI alert, DOJ release and OFAC entry; MITRE lists it as a separate Trojan (S0375)[2, 4, 5, 7] |
| Rana Intelligence Computing Company | Front company named by the FBI, Treasury and DOJ; also called Rana Corp (FBI) and Rana Institute (OFAC)[2, 3, 4, 5] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
US Department of the Treasury (OFAC) 17 September 2020
Sanctioned APT39, 45 individuals and one front company. Said Rana advances the aims of Iran's Ministry of Intelligence and Security (MOIS) and that APT39 was designated for being owned or controlled by the MOIS.[3, 5]
US Department of the Treasury 17 September 2020
Said the 45 individuals were designated for having materially assisted or supported the MOIS, and that their identification came from a long-term FBI Boston Division investigation.[3]
FBI 17 September 2020
Published an alert saying Rana Intelligence Computing Company is a MOIS front company in Tehran that conducts malicious cyber activity, known publicly as APT39, Chafer, Cadelspy, Remexi and ITG07. Coordinated with DHS/CISA and US Treasury.[2]
FBI Director Christopher Wray, quoted by Treasury 17 September 2020
Said Iran's MOIS, through its front company Rana, recruited highly educated people and turned their cyber talents into tools to exploit, harass and repress their fellow citizens and others deemed a threat to the regime.[3]
US Department of Justice 17 September 2020
Described the Treasury sanctions on 45 individuals and one front company associated with the MOIS who comprised the group known publicly as APT39, Chafer, Remexi, Cadelspy or ITG07, as part of a coordinated action on Iranian cyber activity.[4]
US Treasury (OFAC sanctions list) 17 September 2020
Lists APT39 (also Cadelspy, Chafer, ITG07, Remexi) and Rana Intelligence Computing Company (also Rana Institute), each marked as linked to the Iranian Ministry of Intelligence and Security.[5]
US Department of the Treasury 9 September 2022
Said APT39 has engaged in widespread theft of personal identifying information, probably to support surveillance operations, when it sanctioned the MOIS itself.[6]
MITRE ATT&CK 31 July 2026
Describes APT39 as one of several names for cyber espionage activity conducted by the MOIS through the front company Rana Intelligence Computing since at least 2014. Page version 3.2, last modified 31 July 2026.[1]
Sources differ on how the group and the people relate. Treasury says APT39 was designated for being owned or controlled by the MOIS and that the 45 individuals were designated for having materially assisted or supported the MOIS. The Department of Justice release says the 45 individuals and the front company "comprised" the group. Sources also differ on tool names. The FBI alert, the DOJ release and the OFAC list give Cadelspy and Remexi as names of the actor, while MITRE ATT&CK lists them as software used by APT39. Counts of US victims are worded differently: Treasury says approximately 15 US companies, the FBI says more than 15.
Each entry is attributed to the group by the sources cited.
Treasury said the Ministry of Intelligence and Security (MOIS), which it names as the owner of APT39, was previously designated on 16 February 2012.[3]
MITRE ATT&CK describes APT39 as cyber espionage activity run by the MOIS through Rana Intelligence Computing since at least 2014.[1]
MITRE ATT&CK lists 19 February 2019 as the date it created the APT39 group entry (G0087).[1]
The Department of Justice said that from 14 September 2020 the Justice, FBI, Homeland Security and Treasury departments ran a coordinated effort against cyber activity by actors linked to the MOIS and the IRGC.[4]
The FBI published indicators and detection rules for malware it attributes to Rana, including scripts in Office documents, AutoIt malware, two BITS-based executables, a fake Firefox program, Python malware, an Android app and a file called depot.dat. Treasury called it eight separate sets of malware.[2, 3]
OFAC imposed sanctions on APT39, 45 associated individuals and one front company. Treasury said they served at Rana as managers, programmers and hacking experts, and named a long-term FBI Boston Division investigation as the source of the identification.[3]
OFAC's list entries for APT39 (also Cadelspy, Chafer, ITG07, Remexi) and Rana Intelligence Computing Company (also Rana Institute) are each marked as linked to the MOIS.[5]
The Department of Justice described the sanctions and FBI alert as part of coordinated actions against Iranian cyber activity by the MOIS and the IRGC.[4]
When sanctioning the MOIS and its minister, Treasury said APT39 has engaged in widespread theft of personal identifying information, and that the FBI had exposed a years-long MOIS malware campaign that included at least 15 US companies.[6]
MITRE ATT&CK shows version 3.2 of the APT39 page, last modified 31 July 2026.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 17 September 2020 | US Department of the Treasury (OFAC) | SanctionsDesignated APT39, 45 individuals and Rana Intelligence Computing Company under Executive Order 13553. All property and interests in property in the US are blocked and must be reported.[3, 5] |
| 17 September 2020 | FBI | Public alertFLASH ME-000134-MW with indicators of compromise and YARA rules for eight sets of malware tied to Rana.[2, 3] |
| 17 September 2020 | US Department of Justice | Coordinated announcementDescribed the sanctions and the FBI alert as part of coordinated actions with the FBI, DHS and Treasury against Iranian malicious cyber activity.[4] |
| 17 September 2020 | US Treasury (OFAC) | Sanctions list updateAdded entries for APT39 (also Cadelspy, Chafer, ITG07, Remexi) and Rana Intelligence Computing Company (also Rana Institute) to the sanctions list, each marked as linked to the MOIS and subject to secondary sanctions.[5] |
| 9 September 2022 | US Department of the Treasury (OFAC) | Sanctions on the MOISDesignated the MOIS and its minister, and recalled the 2020 APT39 designation.[6] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
MITRE says APT39 sent emails with malicious attachments. The FBI says its scripts were hidden in Office documents sent by spear phishing.[1, 2]
Phishing: Spearphishing Link T1566.002
MITRE says APT39 sent emails with malicious links.[1]
Exploit Public-Facing Application T1190
MITRE says APT39 used SQL injection for initial compromise.[1]
Valid Accounts T1078
MITRE says APT39 used stolen credentials to get into Outlook Web Access.[1]
Remexi Windows Trojan
MITRE describes it as a Windows Trojan written in C and used by APT39. The FBI, DOJ and OFAC also list Remexi as a name of the actor.[2, 4, 5, 7]
Cadelspy Backdoor
MITRE describes it as a backdoor used by APT39. The FBI, DOJ and OFAC also list Cadelspy as a name of the actor.[2, 4, 5, 8]
MechaFlounder Remote access tool
MITRE describes a Python-based remote access tool used by APT39.[9]
VBS and PowerShell malware Script malware
The FBI says malicious VBS scripts were embedded in Office documents and sent by spear phishing.[2]
AutoIt malware Script malware
The FBI identified several AutoIt malware scripts that it says Rana used.[2]
BITS 1.0 and BITS 2.0 Malware using Windows background transfers
The FBI says the BITS 1.0 malware was pulled down by the VBS or AutoIt malware for further victimisation.[2]
Fake Firefox program Malware disguised as software
The FBI identified malware masquerading as legitimate Mozilla Firefox.[2]
Python malware Script malware
The FBI identified Python-based malware that it says Rana used.[2]
Optimizer.apk Android malware
The FBI identified Android malware named optimizer.apk that it says Rana used.[2]
depot.dat Spyware component
The FBI says depot.dat could collect screenshots, keylogger information and other data.[2]
Mimikatz Credential theft tool
MITRE says APT39 used different versions of Mimikatz to obtain credentials.[1]
CrackMapExec Network scanning tool
MITRE says APT39 used CrackMapExec to enumerate network shares.[1]
The FBI lists tasks named UpdatMachine, UpdateMachineG and "Update Windows" that ran its scripts. Review tasks that run scripts every few minutes.
Counters T1053.005
The FBI lists BITS jobs named SecurityCenterUpdate and HelpCenterUpload. Alert on unexpected BITS upload jobs.
Counters T1197
The FBI says to apply regular updates to protect against known vulnerabilities.
Counters T1190
The FBI advises an offline known-good copy and file integrity monitoring so changes to served content show up.
Counters T1505.003
The FBI advises regular scans of systems and applications to find weak points before attackers do.
Counters T1190
Follow government-published indicators and reporting on Iranian state activity and match them to your own environment.
Spot look-alike domains and phishing aimed at your staff and travel-sector partners.
Find public web servers and web mail exposed to the internet so they can be patched and locked down.
See whether staff credentials for web mail have appeared in leaked data.
Check whether leaders and high-risk staff are being targeted with fake messages or leaked personal data.
The US Treasury, FBI and Department of Justice attributed APT39, also called Chafer, to Iran's Ministry of Intelligence and Security (MOIS) on 17 September 2020, saying it worked through the front company Rana Intelligence Computing Company. MITRE ATT&CK describes it the same way.
On 17 September 2020 the US Treasury sanctioned APT39, 45 individuals and Rana. The same day the FBI published an alert with malware indicators, and the Department of Justice described it as part of coordinated action.
MITRE says mainly travel, hospitality, academic and telecommunications firms. Treasury and the FBI add Iranian dissidents and journalists, foreign governments, and about 15 US companies, mostly in travel.
MITRE says APT39 activity largely aligns with a group publicly called Chafer. The FBI, DOJ and OFAC list Chafer among the names for the same actor.
The FBI says its malware came in Office documents sent by spear phishing. MITRE also lists malicious links, stolen web mail credentials and SQL injection.
The FBI published indicators and YARA rules in FLASH ME-000134-MW. Check logs against them and report matches to the FBI's CyWatch.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.