Unveiling TREKX: ITG07's Weapon of Choice for Intrusion in the Transportation Sector

IBM X-Force researchers uncovered a prolonged cyber-espionage campaign by the Iran-linked group ITG07 — also known as Chafer and APT39 — targeting transportation companies across multiple countries. The attackers used a combination of custom malware, stolen credentials, and legitimate system tools to infiltrate networks, move laterally, and maintain persistent access over a period stretching from at least September 2018 through mid-2019. A previously unknown custom remote access trojan called TREKX was identified as a central tool in the operation.

The attack was carried out by ITG07, IBM's designation for the threat group also known as Chafer (Symantec) and APT39 (Mandiant). This is an Iran-based cyber-espionage actor with a history of targeting transportation, telecommunications, and other strategic sectors. Attribution is supported by the use of tools and techniques consistent with known Chafer operations, including BITS-based exfiltration, customized Mimikatz, and webshell deployment. Shared IOC overlap with a separate Chafer report further corroborates this attribution.

This was a cyber-espionage campaign focused on gaining deep, persistent access to transportation sector networks in order to collect intelligence. The attackers were not seeking immediate disruption — they aimed to stay undetected for as long as possible, moving laterally through victim environments, harvesting credentials, and exfiltrating data. The use of a custom RAT, multiple persistence mechanisms, and living-off-the-land techniques reflects a deliberate effort to conduct long-term surveillance rather than a quick smash-and-grab operation.

The campaign was geographically broad, targeting transportation organizations across multiple countries. IBM described the victims as "geographically dispersed," indicating this was not limited to a single region. The operation ran for at least nine months — from September 2018 through at least June 2019 — and involved multiple victim organizations, suggesting a systematic effort to compromise the transportation sector rather than a single targeted intrusion.

The primary targets were organizations in the transportation sector — including companies linked to aviation, as suggested by the use of lookalike domains mimicking Sabre, a major airline technology provider (sabre-css.com, sabre-airlinesolutions.com), and an NVIDIA-branded domain. The attackers also targeted database systems using Navicat, suggesting interest in operational and passenger data held by transportation companies.

The attackers gained initial access by exploiting vulnerabilities in internet-facing applications and deploying webshells (JSPSPY, ASPXSPY) on compromised servers. Once inside, they harvested credentials using a customized version of Mimikatz and LLMNR poisoning techniques, then moved laterally using RDP, PsExec, and SSH tunneling tools (Plink, RemCom). The TREKX RAT was deployed to maintain persistent backdoor access, while Microsoft BITS was abused to quietly transfer tools and exfiltrate data. Internal network scanning with NBTscan helped map victim environments for further exploitation.

Transportation companies — particularly airlines and logistics operators — hold highly sensitive data including passenger manifests, travel itineraries, cargo records, and operational schedules. For an intelligence service, this data can reveal the movements of government officials, military personnel, and persons of interest. Aviation technology vendors like Sabre also provide access to reservation systems used by airlines globally, making them high-value targets for broad intelligence collection. The sector's reliance on interconnected IT systems also makes lateral movement easier once initial access is achieved.