Cadelspy

Cadelspy is a tracking designation associated with a remote access trojan used in APT39 operations, publicly disclosed as part of the US government's September 2020 action against Rana Intelligence Computing. The malware was identified as part of a broader toolkit linked to Iranian MOIS-directed cyber espionage activity targeting telecommunications and travel organizations. As with other Rana/APT39 malware families documented in the same disclosure, Cadelspy was designed to collect personal information and enable persistent access to compromised systems in support of Iranian surveillance objectives.