Threat actor · all actors

APT39G0087 state

aka APT39, ITG07, Chafer, Remix Kitten, COBALT HICKMAN, G0087, Radio Serpens, TA454, Burgundy Sandstorm

Last updated: 2026-07-03

0attributed CVEs

72ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	52 / 72	72%
`CM-6`	47 / 72	65%
`CM-2`	44 / 72	61%
`CM-7`	37 / 72	51%
`SI-3`	37 / 72	51%
`AC-3`	35 / 72	49%
`AC-6`	33 / 72	46%
`CA-7`	33 / 72	46%
`AC-2`	31 / 72	43%
`SC-7`	25 / 72	35%
`AC-4`	24 / 72	33%
`SI-7`	23 / 72	32%
`AC-5`	22 / 72	31%
`CM-5`	22 / 72	31%
`IA-2`	20 / 72	28%

Co-occurring actors

None.

Similar actors

Similar TTPs

APT3 0.40
menuPass 0.37
Silence 0.37
FIN13 0.36
Operation Wocao 0.36