Actors Insights|Latest update04/07/2026

Chafer

Named by SymantecSuspected state sponsor: Islamic Republic of Iran

Chafer is the name used by Symantec to track the Iranian espionage cluster widely known as APT39. Active since at least 2014, the group targets telecommunications, travel, aviation, and government organizations across the Middle East, focusing on the collection of personal information for Iranian surveillance purposes. Chafer operations are characterized by spear phishing, web shell deployment, and the use of both custom backdoors and publicly available tools such as Mimikatz and PsExec for credential theft and lateral movement. The cluster is also tracked as APT39 (Mandiant) and ITG07 (IBM).

First Seen:Jul 2014
Last Seen:Sep 2020
Indexed Reports:6
Public IOCs:161
Cluster: APT39Mitre: APT39Misp: APT39
also known as:
Chafer (Symantec)Remix Kitten (CrowdStrike)COBALT HICKMAN (SecureWorks)G0087 (Mitre)Radio Serpens (Palo Alto)TA454 (Proofpoint)ITG07 (IBM)Burgundy SandstormAPT39 (Mandiant)

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Germany
DE
Germany
Germany
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Iran
IR
Iran
Iran
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Mar 2018 ~ Jan 2019
Mar 2018 ~ Jan 2019
Mar 2018 ~ Jan 2019
Iraq
IQ
Iraq
Iraq
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Israel
IL
Israel
Israel
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jordan
JO
Jordan
Jordan
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Kuwait
KW
Kuwait
Kuwait
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Netherlands
NL
Netherlands
Netherlands
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Pakistan
PK
Pakistan
Pakistan
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2018 ~ May 2020
Jan 2017 ~ Feb 2018
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Jan 2018 ~ May 2020
Singapore
SG
Singapore
Singapore
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Sudan
SD
Sudan
Sudan
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Tajikistan
TJ
Tajikistan
Tajikistan
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Thailand
TH
Thailand
Thailand
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Turkey
TR
Turkey
Turkey
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Nov 2018 ~ Mar 2019
Nov 2018 ~ Mar 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
United Kingdom
GB
United Kingdom
United Kingdom
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
United States
US
United States
United States
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jul 2014 ~ Dec 2015
Jan 2014Jun 2026

Targeted Sectors

Government Agencies and ServicesAerospaceInformation TechnologyTelecommunicationTransportationConsultingLogistics

Recent Indexed Reports

  1. Public
    Iranian Chafer APT Targets Kuwait and Saudi Arabia’s Critical Sectors
  2. Public
    The Invisible Threat: Chafer's Advanced Backdoor Malware Analysis
  3. Public
    Unraveling MechaFlounder: Chafer's New Python-Based Tool Targets Turkey
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.