Unmasking APT39: Cyber Attacks on a Global Scale with Focus on the Middle East

In December 2018, FireEye identified APT39 as an Iranian cyber espionage group responsible for a sustained, large-scale campaign stealing personal information from organizations across the globe. The group has been active since at least November 2014, targeting telecommunications companies, travel firms, and IT providers — primarily in the Middle East — to collect data on individuals of interest to the Iranian government.

APT39 is an Iranian state-sponsored cyber espionage group. FireEye assessed with moderate confidence that the group operates in support of Iranian national interests, based on its regional targeting patterns, infrastructure, and operational timing. The group shares some similarities with APT34 (also known as OilRig), including malware delivery methods and infrastructure naming conventions, but is tracked as a distinct actor due to its use of a different POWBAT backdoor variant.

The campaign is a long-running cyber espionage operation focused on collecting personal information — including travel itineraries, communication records, and customer data — to enable surveillance and tracking of specific individuals. The goal is to support Iranian national security priorities, which may include monitoring dissidents, tracking persons of interest, and gathering geopolitical intelligence from government entities.

APT39's targeting is global but concentrated in the Middle East. Confirmed victim countries include Egypt, Iraq, Israel, Kuwait, Qatar, Saudi Arabia, Spain, Turkey, the United Arab Emirates, and the United States. The group has been active for over a decade, running persistent intrusion campaigns across multiple continents, making it one of the more broadly active Iranian espionage actors tracked by Western intelligence firms.

APT39 primarily targets the telecommunications and travel sectors, along with IT firms that support them and the high-tech industry. Government entities have also been targeted, likely to collect geopolitical intelligence. Individuals of interest to the Iranian government — including dissidents, dual nationals, and people with connections to foreign governments — are the ultimate targets of the data collection, with telecom and travel companies serving as conduits to reach them.

APT39 typically gained initial access through spear phishing emails containing malicious attachments or links, exploitation of vulnerable public-facing web servers to install web shells, or abuse of stolen credentials against services like Outlook Web Access. Once inside, the group deployed custom backdoors (SEAWEED, CACHEMONEY, POWBAT) for persistence, used tools like Mimikatz and ProcDump to harvest credentials, and moved laterally using RDP, SSH, and PsExec. Custom SOCKS5 proxy tools (REDTRIP, PINKTRIP, BLUETRIP) were used to tunnel traffic between infected hosts, and collected data was archived with WinRAR or 7-Zip before being exfiltrated.

Telecommunications and travel companies hold large volumes of personal data — including call records, travel itineraries, and customer identities — that can be used to track and monitor individuals of interest to the Iranian government. IT firms supporting these sectors are also targeted because compromising them can provide indirect access to the same data at scale. Government entities are targeted for geopolitical intelligence. In short, these sectors serve as aggregators of exactly the kind of personal information APT39 needs for its surveillance mission.