APT39: A Closer Look at Iran's Cyber Espionage Operation Targeting Travel and Telecommunications

Espionage in service of surveillance.

APT39 — also tracked as Chafer, Remix Kitten, and ITG07 — is an Iranian cyber espionage group assessed with high confidence to operate on behalf of Iran's Ministry of Intelligence and Security (MOIS). First publicly identified by FireEye (now Mandiant) in 2019 with activity dating back to at least 2014, APT39 occupies a distinctive niche in Iran's cyber operations: where other Iranian groups focus on destructive attacks, intellectual property theft, or regional geopolitical disruption, APT39's primary objective is the collection of personal information that supports physical surveillance and tracking of individuals.

This makes APT39 unusual. Their targets are not chosen for their economic value or strategic military significance. They are chosen because they hold data about people — travel itineraries, booking records, call detail records, passport information, hotel reservations, and telecommunications metadata. The group compromises the organisations that process this data — airlines, travel agencies, telecommunications providers, hospitality companies, and government immigration systems — to build a surveillance capability that tracks the movements and communications of specific individuals of interest to the Iranian state.

Understanding APT39 matters for penetration testers and defenders because their tactics, techniques, and procedures (TTPs) are well-documented, their targeting is predictable, and their operational patterns illustrate how a patient, well-resourced adversary conducts long-term espionage operations against sectors that often underestimate their attractiveness as intelligence targets.

Who they are and who they serve.

Attribution of APT39 to the Iranian government is supported by multiple independent sources. In September 2020, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned an Iranian front company — Rana Intelligence Computing Company — and 45 associated individuals, explicitly linking Rana to MOIS and to the cyber operations tracked as APT39. The FBI simultaneously released a detailed technical advisory identifying malware tools and infrastructure tied to Rana's operations.

Organisations that hold data about people.

APT39's target selection directly reflects their intelligence collection mission. Every confirmed target sector holds data that would support the surveillance and tracking of individuals. The group's operations have been observed across the Middle East, Europe, North America, and South Asia — wherever organisations process data relevant to their collection requirements.

How they get in.

APT39's initial access techniques are effective rather than sophisticated. They rely on proven methods — spear-phishing and exploitation of public-facing applications — executed with patience and operational discipline. The group invests more effort in persistence and data collection than in novel exploitation, which reflects a mature operational mindset: use what works reliably and save complexity for where it is needed.

The malware and utilities in their arsenal.

APT39 employs a mix of custom malware, modified open-source tools, and legitimate system utilities. Their custom tools are functional rather than elegant — designed for reliability and stealth over sophistication. The group's willingness to use publicly available tools alongside custom malware makes attribution harder and detection more dependent on behavioural analysis than signature matching.

What they do once inside.

APT39's post-compromise behaviour is methodical and patient. The group follows a consistent operational pattern: establish persistence, conduct internal reconnaissance, escalate privileges, move laterally toward data repositories, and then systematically extract the data they came for. Operations against individual targets have been sustained for months, with the group maintaining access even through security incidents and partial remediation.

The patience of this operational tempo is the defining characteristic. APT39 does not smash and grab. They establish persistent access, carefully identify the specific data repositories that serve their intelligence requirements, and then conduct sustained, low-volume extraction that is designed to blend with normal database activity. A single SQL query returning fifty records does not trigger volume-based data loss prevention alerts. Repeated daily over six months, it yields nine thousand records.

Techniques across the kill chain.

Mapping APT39's known techniques to the MITRE ATT&CK framework provides a structured view of their operational capabilities and — critically — identifies the detection opportunities at each phase. Defenders who instrument their environments against these specific techniques significantly increase the probability of detecting APT39 operations early in the kill chain.

How their operations are hosted and managed.

APT39's command and control infrastructure follows patterns common to Iranian cyber operations, with some distinctive characteristics. Understanding these patterns supports both proactive threat hunting and incident response when investigating potential APT39 activity.

Finding APT39 in your environment.

Detecting APT39 requires moving beyond signature-based detection toward behavioural analysis and anomaly identification. Their use of legitimate tools, custom malware with evolving signatures, and patient operational tempo means that any single indicator of compromise (IoC) has a limited shelf life. The following hunting approaches focus on behaviours that persist even as specific tools and infrastructure change.

Protecting your organisation from state-sponsored espionage.

Defending against APT39 — and state-sponsored threats generally — requires accepting that a sufficiently resourced and patient adversary will eventually find a way in. The defensive strategy must therefore focus not only on preventing initial access but on detecting post-compromise activity early, limiting lateral movement, protecting the data assets the adversary is seeking, and being able to respond effectively when compromise is discovered.

What APT39 teaches us about testing priorities.

APT39's operations provide a real-world template for how penetration testing engagements should be structured for organisations in targeted sectors. Their TTPs are well-documented, their objectives are clear, and their attack paths are reproducible in a controlled testing environment.

A penetration test modelled on APT39's TTPs tells the organisation something specific and actionable: could this particular threat actor, using these particular techniques, reach the data they are known to target in our environment? This is threat-led testing — and it produces findings that map directly to the real risk the organisation faces, rather than a generic list of vulnerabilities with no adversary context.

The bottom line.

APT39 is a focused, patient, and persistent threat actor conducting cyber espionage in service of Iran's surveillance apparatus. They target organisations that hold data about people — airlines, telecoms, hotels, immigration systems, and the IT companies that serve them. Their techniques are proven rather than novel: spear-phishing, known-vulnerability exploitation, credential theft, Pass-the-Hash, and careful, low-volume data extraction sustained over months.

For defenders in targeted sectors, APT39 represents a specific, documentable threat that can be planned against. Their TTPs are catalogued in MITRE ATT&CK. Their tooling is analysed in public reporting. Their targeting patterns are predictable. This is an adversary you can prepare for — and preparation means implementing the controls that degrade their capabilities at every stage of the kill chain, from MFA that blocks phished credentials through to database monitoring that detects anomalous queries against PNR tables.

The organisations most at risk are those that hold surveillance-relevant data and have not yet internalised that this makes them an intelligence target. If your organisation processes travel records, telecommunications metadata, guest registrations, or identity documents — and particularly if you operate in or serve clients in the Middle East — APT39 is a threat you should be actively defending against.