In a January 2019 threat intelligence report, Mandiant formally identified APT39 as a distinct Iranian cyber espionage group whose singular focus on mass personal data collection sets it apart from other Iranian threat actors engaged in disruptive attacks and influence operations. Tracked by FireEye since November 2014 and largely overlapping with the publicly reported "Chafer" group, APT39's mission centers on the systematic theft of personal information — travel itineraries, customer databases, and communications metadata — to enable monitoring, tracking, and surveillance of individuals aligned with Iran's national security priorities.
Targeting: Telecom and Travel at Scale
APT39's targeting is geographically global but operationally concentrated in the Middle East, with primary focus on telecommunications providers, travel industry firms, and the IT companies supporting them. The strategic logic is clear: telecommunications companies store vast quantities of personal and communications data, provide access to critical infrastructure, and serve as gateways to targets across multiple verticals. Government entities represent a secondary targeting tier, suggesting a parallel interest in geopolitical intelligence collection.
The group's operational intent, as assessed by Mandiant, is to monitor and track specific individuals, collect proprietary and customer data serving strategic national requirements, and pre-position within compromised networks to enable future campaigns.
Iran Nexus and APT34 Overlap
Mandiant assesses with moderate confidence that APT39 operates in support of Iranian national interests, based on regional targeting patterns, infrastructure characteristics, operational timing, and technical overlaps with APT34 (OilRig). Both groups share malware distribution methods, use of the POWBAT backdoor, and infrastructure naming conventions — but APT39 uses a distinct POWBAT variant, and Mandiant treats them as separate intrusion sets that may share resources or coordinate operations at some level.
Attack Lifecycle and Custom Tooling
APT39 employs a full-spectrum intrusion toolkit across each phase of the attack lifecycle:
- Initial Access: Spear-phishing emails with malicious attachments or hyperlinks leading to POWBAT infections; exploitation of vulnerable web servers to deploy ANTAK and ASPXSPY web shells; and credential theft targeting Outlook Web Access (OWA) resources. The group frequently registers lookalike domains impersonating legitimate web services relevant to intended targets.
- Foothold and Privilege Escalation: Custom backdoors SEAWEED, CACHEMONEY, and the group-specific POWBAT variant establish persistence. Freely available tools — Mimikatz, Ncrack, Windows Credential Editor, and ProcDump — support credential harvesting and privilege escalation. In at least one case, APT39 used a repacked Mimikatz variant specifically modified to evade antivirus detection, and performed credential harvesting outside the compromised environment to avoid triggering internal alerts.
- Internal Reconnaissance: Custom scripts and the port scanner BLUETORCH map the target environment.
- Lateral Movement: RDP, SSH, PsExec, RemCom, and xCmdSvc facilitate movement across hosts. Custom SOCKS5 proxy tools — REDTRIP, PINKTRIP, and BLUETRIP — tunnel traffic between infected hosts to obscure lateral movement activity. RDP also serves a dual purpose as a persistence mechanism.
- Exfiltration: Stolen data is archived using WinRAR or 7-Zip before exfiltration.
Strategic Significance
APT39's operations illustrate how cyber espionage can serve as a low-cost, scalable tool for authoritarian surveillance at global reach. The threat extends beyond the directly targeted organizations to their entire customer base — meaning a successful telecom breach potentially exposes the personal data of millions of individuals across multiple countries and industries to Iranian intelligence collection. Mandiant assesses the group's activities as a direct reflection of Iran's strategic use of cyber operations to monitor perceived national security threats and gain competitive advantages against both regional and global rivals.