threat actor

APT39

unknownentity:threat_actor

APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a group publicly referred to as "Chafer." However, there are differences in what has been publicly reported due to the variances in how organizations track activity. APT39 primarily leverages the SEAWEED and CACHEMONEY backdoors along with a specific variant of the POWBAT backdoor. While APT39's targeting scope is global, its activities are concentrated in the Middle East

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: apt39
kind: threat actor
status: unknown
aliases: Burgundy Sandstorm · Chafer · CINDER ION · COBALT HICKMAN · G0087 · ITG07 · Radio Serpens · Remix Kitten · REMIX KITTEN · TA454
jurisdictions: —
claims naming it: 0 · 0 attributions · 4 relations · 0 events

Identifiers

attack G0087via mitre-attack
misp-galaxy c2c64bd3-a325-446f-91a8-b4c0f173a30bvia misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatAPT39usesMechaFlounder
fetch —sha256 dc1639caa5501d72
rel_216btcintel:relations:216@v1 sha256:d41525f3ab5a0304
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT39usesRemexi
fetch —sha256 dc1639caa5501d72
rel_217btcintel:relations:217@v1 sha256:aa8d1b8178320975
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT39usesCadelspy
fetch —sha256 dc1639caa5501d72
rel_218btcintel:relations:218@v1 sha256:9addc799e230c25e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT39usesASPXSpy
fetch —sha256 dc1639caa5501d72
rel_219btcintel:relations:219@v1 sha256:8873dafcd6e7fb96
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.