ITG07

ITG07 is IBM X-Force's designation for the Iranian threat cluster known as APT39. Active since at least 2014, the group focuses on espionage and personal information theft targeting telecommunications, travel, and government organizations. IBM's tracking of this cluster aligns closely with Mandiant's APT39 and Symantec's Chafer reporting, covering the same TTPs: spear phishing, web shell deployment, custom backdoor usage, and large-scale data collection. The cluster is assessed to operate in support of Iranian state surveillance interests.