APT39
APT39 is a threat actor also tracked as Burgundy Sandstorm, Cadelle, Chafer, ITG07, and Remix Kitten. The provided content associates the group with espionage-style post-compromise activity including spearphishing with malicious attachments for initial access, PowerShell-based execution, internal reconnaissance, remote system discovery, system user discovery, Windows Registry querying, file and directory discovery, clipboard theft, credential theft, persistence via the Startup folder, data staging, exfiltration, and artifact deletion. The content specifically states that APT39 has sent spearphishing emails to lure users into clicking malicious attachments; used PowerShell to execute malicious code; used tools to search for files on compromised hosts; used Remexi to collect usernames from systems; used tools capable of stealing clipboard contents; used multiple malware strains to query the Windows Registry; used NBTscan and custom tools to discover remote systems; modified and used customized versions of publicly available tools such as PLINK and Mimikatz; used SmartFTP Password Decryptor to decrypt FTP passwords; utilized tools to aggregate data prior to exfiltration; stolen files from compromised hosts; exfiltrated stolen victim data through command-and-control communications; and deleted files after deployment on compromised hosts. For command and control, the content states that APT39 has used HTTP in communications with C2, communicated with C2 through files uploaded to and downloaded from Dropbox, and used various tools to proxy C2 communications, including malware disguised as Mozilla Firefox and a tool named mfevtpse.exe designed to mimic the legitimate McAfee file mfevtps.exe. For persistence, the content states that APT39 has maintained persistence using the Windows Startup folder. The content also states that APT39 used malware to decrypt encrypted CAB files. One report in the provided material additionally notes that infrastructure linked to APT39 was among OVH-hosted command-and-control servers disrupted by the March 2021 OVHcloud Strasbourg data center fire. The provided content does not explicitly state a sponsoring country.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
54 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
25 malware families attributed to this actor across reporting.
20 additional families tracked in Mallory.
Associated vulnerabilities
9 CVEs this actor has used in observed campaigns. 9 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.
4 more CVEs tied to this actor tracked in Mallory.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Listed in the detection annotations as a threat actor associated with this analytic context.
Named threat actor referenced in global threat reporting.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.