Chafer
Attribution profile
- Type
- Nation State
- Location
- Iran
- Known incidents
- 2 incidents
- Sources
- 1 source
- First seen
- 2018-11-01
- Last seen
- 2023-05-24
- Updated
- 2026-10-11 07:12
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Chafer, also known as APT39, is an Iran‑linked threat actor active since at least mid‑2014, distributing data‑stealer malware focused on surveillance and tracking of individuals. Its observed targets include government entities, such as a Turkish government body compromised in November 2018 and Spain’s state meteorological agency (Aemet) hit in May 2023, which forced the temporary suspension of the SINOBAS public science project and affected meteoglossary and Antarctic weather‑station operations. Chafer’s tooling is typified by the Python‑based MechaFlounder backdoor first seen in the 2018 Turkish intrusion; the malware is packaged with PyInstaller into a portable executable, delivered via the win10‑update[.]com domain, and maintains persistent HTTP contact with a C2 server. It provides file upload/download, command execution, uses the mechanize module for exfiltration, and encodes output with base16. The group has reused infrastructure from earlier Chafer campaigns and shares code elements with the Oilrig threat group, indicating possible collaboration.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 1 source.