^[3][4][5]

Activities associated with APT39 largely align with a group publicly referred to as Chafer.^{[1][2][6][3][4][5]}

^[7]

APT39 has used HTTP in communications with C2.^[8][3]

APT39 has used remote access tools that leverage DNS in communications with C2.^[8]

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.^[1]

APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.^[3]

APT39 has maintained persistence using the startup folder.^[1]

APT39 has modified LNK shortcuts.^[1]

APT39 has used Ncrack to reveal credentials.^[1]

APT39 has used tools capable of stealing contents of the clipboard.^[9]

APT39 has utilized custom scripts to perform internal reconnaissance.^[1][3]

APT39 has used PowerShell to execute malicious code.^[8][9]

APT39 has utilized malicious VBS scripts in malware.^[3]

APT39 has used a command line utility and a network scanner written in python.^[8][3]

APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.^[3]

APT39 has created accounts on multiple compromised hosts to perform actions within the network.^[8]

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.^[8]

APT39 has used various tools to steal files from the compromised host.^[9][3]

APT39 has utilized tools to aggregate data prior to exfiltration.^[3]

APT39 has used malware to decrypt encrypted CAB files.^[3]

APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.^[3]

APT39 has exfiltrated stolen victim data through C2 communications.^[3]

APT39 has used SQL injection for initial compromise.^[9]

APT39 has used tools with the ability to search for files on a compromised host.^[3]

APT39 has used malware to delete files after they are deployed on a compromised host.^[3]

APT39 has downloaded tools to compromised hosts.^[9][3]

APT39 has utilized tools to capture mouse movements.^[3]

APT39 has used tools for capturing keystrokes.^[9][3]

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.^[8][3]

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.^[1][8]

APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.^[8]

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.^[1][8]

APT39 has used malware to drop encrypted CAB files.^[3]

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.^[8][10]

APT39 has used different versions of Mimikatz to obtain credentials.^[8]

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.^[1]

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.^[1][9][3]

APT39 leveraged spearphishing emails with malicious links to initially compromise victims.^[1][3]

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.^[1][8]

APT39 has used various tools to proxy C2 communications.^[8]

APT39 has used various strains of malware to query the Registry.^[3]

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.^[1][8]

APT39 has used SMB for lateral movement.^[9]

APT39 used secure shell (SSH) to move laterally among their targets.^[1]

APT39 has used NBTscan and custom tools to discover remote systems.^[1][8][9]

APT39 has created scheduled tasks for persistence.^[1][8][3]

APT39 has used a screen capture utility to take screenshots on a compromised host.^[9][3]

APT39 has installed ANTAK and ASPXSPY web shells.^[1]

APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.^[3]

APT39 used Remexi to collect usernames from the system.^[2]

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.^[8][9]

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.^[1][3]

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.^[1][8][9][3]

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).^[1]

APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.^[8]