IranAttributedMOISEspionageActive 2014 – 2020APT39
Also known asChafer · Remix Kitten · ITG07 · COBALT HICKMAN · TA454 · Radio Serpens · Burgundy Sandstorm
Summary
MOIS cyber-espionage activity conducted through the front company Rana Intelligence Computing (MITRE; US Treasury). Mandiant assesses that its key mission is to track or monitor targets of interest, collect personal information, including travel itineraries, and gather customer data from telecommunications firms; Treasury says the campaign targeted Iranian dissidents, journalists and international companies in the travel sector. On 17 September 2020 OFAC sanctioned APT39, 45 associated individuals and one front company (Rana) under E.O. 13553, and the concurrent FBI advisory detailed eight separate and distinct sets of Rana malware. Bitdefender (2020) documented intrusions against air-transportation and government victims in Kuwait and Saudi Arabia.
Attribution
Through front company Rana Intelligence Computing
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Treasury (OFAC) (Government, 2020-09-17)
Sanctions: front company Rana Intelligence Computing is owned or controlled by the MOIS - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
MOIS activity through front company Rana
Campaigns 1
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Rana — MOIS Surveillance Programme | 2014 – 2020-09 | Iran, Middle East, USA | Telecom, Travel, Academia, Government | OFAC designation 17 Sep 2020 (E.O. 13553) with concurrent FBI advisory — 45 individuals and front company Rana Intelligence Computing designated; end date marks public disruption, not assessed cessation; end is the designation date (Treasury: a "years-long" campaign, last operation not dated) — ongoing at designation |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 9
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution2 | T1059.001PowerShellT1059.010AutoHotKey & AutoIT |
| Persistence1 | T1547.009Shortcut Modification |
| Privilege Escalation1 | T1546.010AppInit DLLs |
| Defense Impairment1 | T1553.006Code Signing Policy Modification |
| Credential Access1 | T1003OS Credential Dumping |
| Collection2 | T1056Input CaptureT1115Clipboard Data |
Malware and tools 8
| Name | Description | Platform |
|---|---|---|
| SEAWEED | Backdoor | Windows |
| CACHEMONEY | Backdoor | Windows |
| POWBAT | PowerShell Backdoor | Windows |
| Remexi | Backdoor | Windows |
| BITS 1.0 | Backdoor (BITS abuse) | Windows |
| BITS 2.0 | Backdoor (BITS abuse) | Windows |
| Depot.dat | Data-collection malware (screenshots, keylogging) | Windows |
| optimizer.apk | Android malware implant (FBI name: optimizer.apk) | Android |
Infrastructure patterns
- Registers domains that masquerade as legitimate web services and organisations relevant to the target (Mandiant, 2019)
- Dropbox file transfers and DNS-based remote-access tools for C2 (MITRE ATT&CK, 2026)
- Custom SOCKS5 proxies; mfevtpse.exe, mimicking McAfee, proxies C2 (MITRE ATT&CK, 2026)
Reporting and advisories 6
- Mandiant
APT39: Iranian Group Focused on Personal Information - US Treasury / OFAC
Treasury Sanctions Cyber Actors Backed by Iranian Intelligence Ministry (APT39, Rana, 45 individuals) - FBI
Advisory — previously undisclosed Iranian (Rana) malware used to monitor dissidents, travel and telecom companies - MITRE ATT&CK
APT39 (G0087) group profile - FBI
FLASH — Indicators of Compromise Associated with Rana Intelligence Computing (Sep 2020) - Bitdefender
Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia (May 2020)