APT39
IntrusionSet · ATTACK:enterprise:G0087
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0087",
"title": "APT39",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0087",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--44e43fad-ffcb-4210-abcf-eaaed9735f80",
"external_id": "G0087",
"domain": "enterprise",
"created": "2019-02-19T16:01:38.585Z",
"modified": "2026-07-31T18:47:52.580Z",
"version": "3.2",
"aliases": [
"APT39",
"ITG07",
"Chafer",
"Remix Kitten"
],
"tactics": [
],
"source_references": [
{
"source_name": "Remix Kitten"
},
{
"source_name": "ITG07"
},
{
"source_name": "APT39"
},
{
"source_name": "Chafer"
},
{
"source_name": "Crowdstrike GTR2020 Mar 2020",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
},
{
"source_name": "Dept. of Treasury Iran Sanctions September 2020",
"url": "https://home.treasury.gov/news/press-releases/sm1127"
},
{
"source_name": "DOJ Iran Indictments September 2020",
"url": "https://www.justice.gov/opa/pr/department-justice-and-partner-departments-and-agencies-conduct-coordinated-actions-disrupt"
},
{
"source_name": "FBI FLASH APT39 September 2020",
"url": "https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"
},
{
"source_name": "FireEye APT39 Jan 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
},
{
"source_name": "Dark Reading APT39 JAN 2019",
"url": "https://www.darkreading.com/attacks-breaches/iran-ups-its-traditional-cyber-espionage-tradecraft/d/d-id/1333764"
},
{
"source_name": "Symantec Chafer Dec 2015",
"url": "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"
}
]
}Explicit source assertions (64)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02caaeff-7429-444f-bac2-498fe3a73cfd
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05509bce-dc88-4cc9-8c39-40549cbc8603
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0574a456-6327-4f07-94b0-58be6ecbf8b8
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--073aff0c-1dd2-40f4-87da-d90809f3418a
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--089eeb46-323e-410b-a27b-dc5ff4467c40
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ddcf163-015f-46a2-8de7-375712d92bae
Symantec Chafer February 2018 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e4c55fc-a923-4c05-89ce-3102620a41d7
Symantec Chafer February 2018 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f50a4e4-6ceb-4ead-88ed-147592e0b398
BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f81e969-dfc4-4d37-8664-59c31bd7116c
Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f93a49a-11c8-49d8-9b58-e7136e6bc850
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1553.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16ee08e8-a66a-4022-a322-148eeaf71771
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1546.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19785182-3304-4954-9545-30560d159ae2
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0459
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21d94923-38bb-489d-bc6a-23e03fef7b91
Unit 42 MechaFlounder March 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25557d9f-bfa0-4da7-8352-ab56b82b475b
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0375
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a37ddb3-56ef-4c2d-bec7-d6060eb0215a
Symantec Chafer Dec 2015 · Securelist Remexi Jan 2019 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--307e732c-c407-4466-951b-38062bb5e32b
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--364be248-6fa2-42a2-847b-35e6f43fd06d
BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0488
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37fee9dc-701e-49be-8cec-b2fde4b533d8
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38cf696a-f98d-4b32-a9f1-0183bd78b6d2
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b1a912a-9854-428f-9dde-bd2100c554d8
Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e91f49c-5342-49d8-8105-7ab17c5ef9f4
IBM ITG07 June 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42ddce39-b653-4466-b7ff-a9554029f1c6
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--439344c5-67e0-4d38-9b91-866392e5e232
Symantec Chafer Dec 2015ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47b76f42-e305-4aac-a1cc-d7cb84b1d8bf
FireEye APT39 Jan 2019 · Dark Reading APT39 JAN 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bc2e50e-0753-497f-9ec0-af270abe2af1
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c5f4c95-2eca-4f8d-8e7e-16f0bb323b07
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e50db0c-4e54-4266-b675-3b279ec45427
FBI FLASH APT39 September 2020 · FireEye APT39 Jan 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ecf2ecd-ae5a-417b-a6a7-9690fb83a282
FireEye APT39 Jan 2019 · Dark Reading APT39 JAN 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54d5380e-07a4-49b0-8ffd-c34428c90bbe
FBI FLASH APT39 September 2020 · FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58a1976b-122d-41df-ae40-b66826ad8f4f
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b875be8-3849-46e2-80cb-dec502f78f52
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d4ba3fe-d782-47e4-ad82-0b81142a5e1a
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0454
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e2b2df2-e54f-44b5-bd86-fefdae513bc2
Symantec Chafer Dec 2015ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fea62e7-67f8-4ff2-875d-a48393f99135
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60f1cf34-8c60-47b7-ba9a-88c2575006f9
Symantec Chafer February 2018 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66e8d05b-6f51-461d-aec0-266970064939
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b9c3bc4-8805-4074-9a0c-ef3d4c69656c
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77e0980c-de43-48a8-8df3-b924f8d91b51
FireEye APT39 Jan 2019 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b2af30a-523f-41fe-88c3-ab2ee15bdec5
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--932beba4-bb6a-4174-abe3-353d2e39337c
Symantec Chafer February 2018 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--948eaafc-3440-43f3-b9e4-39eb77197d72
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--964233cc-fa6c-4754-9684-6546eb6d5a4a
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a66e38c-ea79-4b7b-bf74-555da87d58c3
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0073
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cc2f27e-bf85-4471-8be5-0cf614cd5840
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1c62ce5-2f11-415f-bca1-c9021530c090
FBI FLASH APT39 September 2020 · FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a538c673-e7f2-4fd0-923e-d874a3f3d363
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba65edc3-e0ef-477f-92c8-ffa2e2a943c5
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3cef083-71f7-46ed-85c1-0b44ac24b85e
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4a566d6-69ce-4284-809d-433663e3e2fa
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1197
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6b51e0c-d6a8-4815-b1fe-fb065ac0bcaa
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6f11dfe-dd59-4310-9619-ed42ee48d736
BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c906ddd0-e3fb-42ad-84cb-84ca093ddbb2
FBI FLASH APT39 September 2020 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d741a245-42ea-4bd4-bfb5-5687981e46b3
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7a244fa-f52c-4e54-9088-6f9ccda8b2b9
FBI FLASH APT39 September 2020 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9dce15d-68d8-46af-a7ec-354bf5093c49
FBI FLASH APT39 September 2020 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1090.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2ebd73f-9198-49c7-b446-00478a466e78
FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea230e17-d23a-4a11-b2f9-358eeeea4ea3
FireEye APT39 Jan 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f11ab582-8ea8-4ed7-9b1e-2b31dce390da
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5cd03ce-93e0-4458-ba90-ca3926bb41b9
FireEye APT39 Jan 2019 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f60a3a4e-ba53-47ba-8e31-e301f3983f6e
FireEye APT39 Jan 2019 · Symantec Chafer February 2018 · FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa82d7c2-bdc5-4945-9d59-5b40eb9a7454
Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fab9f76e-570c-4235-8045-dec89714d435
Symantec Chafer February 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd6bd6fd-4a75-4094-ac67-bc14cb6b44bb
FBI FLASH APT39 September 2020ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe8bc44b-805d-440c-a447-96091033439d
FireEye APT39 Jan 2019