Remexi

Remexi is a Windows backdoor associated with APT39 cluster activity, first documented by Kaspersky as a tool used to spy on dissidents and foreign entities inside Iran. The malware is capable of keylogging, screenshot capture, browser credential theft, and remote command execution, making it well-suited to targeted surveillance operations. Remexi shares code characteristics with tooling used in broader Chafer and APT39 campaigns. It was publicly linked to the APT39 cluster as part of the US government's September 2020 attribution of Rana Intelligence Computing to Iranian MOIS operations.