Chafer APT Targets Iranian Diplomatic Entities with Updated Remexi Malware

Throughout autumn 2018, the Iran-linked Chafer APT group ran a targeted cyber-espionage campaign against foreign diplomatic missions based in Iran. The attackers used an updated and more capable version of the Remexi malware to silently collect sensitive information from victim computers — including keystrokes, screenshots, browser data, and credentials — and send it back to attacker-controlled servers. Kaspersky researchers, who analyzed the campaign while it was still active, described it as a likely domestic counter-intelligence operation.

The attack was carried out by Chafer, also tracked as APT39, an Iran-based threat group previously documented by Symantec. Kaspersky attributed the campaign based on the use of Remexi malware — a tool historically associated with Chafer — and additional cultural indicators within the malware code. Notably, one sample used the Farsi word "salamati" (meaning "health") as an encryption key, strongly suggesting Iranian operators. The targeting of foreign diplomats inside Iran points to a state-directed surveillance effort.

This was a cyber-espionage operation aimed at collecting intelligence from foreign diplomatic personnel operating inside Iran. The malware was designed to comprehensively monitor victims — capturing keystrokes, taking screenshots of specific windows, stealing browser credentials and browsing history, and recording clipboard activity. The attackers could also execute remote commands on victim machines. The goal was persistent, covert surveillance rather than disruption or financial gain.

The campaign was geographically narrow but strategically significant — focused entirely on foreign diplomatic entities based inside Iran. Kaspersky's telemetry confirmed the campaign was active for at least several months during autumn 2018 and was still ongoing at the time of analysis. Only Iran appears as a confirmed targeted country, but the victims were foreign nationals and missions from multiple countries stationed there, making the potential intelligence reach considerably wider.

The primary targets were foreign diplomatic missions and their staff based in Iran — embassies, consulates, and similar government entities. The attackers configured the malware to capture activity on specific windows of interest, including those related to VPN logins, email, and security tools, suggesting they were particularly interested in communications and credentials used by diplomatic personnel.

The malware was likely delivered via a compiled AutoIt dropper that used hardcoded FTP credentials to fetch and install Remexi on victim machines. Once installed, Remexi established persistence through Windows scheduled tasks and registry run keys, then began silently collecting data. It used Microsoft's Background Intelligent Transfer Service (BITS) — a legitimate Windows file transfer tool — to receive commands from attackers and upload stolen data, disguising malicious traffic as normal system activity. All collected data was encrypted before being sent to the attacker's server.

Foreign diplomatic missions hold sensitive government communications, classified cables, travel plans, and contacts with local sources — all of high intelligence value to a host state seeking to monitor foreign influence on its territory. By compromising diplomatic computers, the attackers could intercept communications before encryption, capture login credentials for secure systems, and track the activities of foreign officials. This type of access is difficult to obtain through other means and provides persistent, real-time intelligence.