APT39

APT39 is an advanced persistent threat (APT) group that has been active since at least 2014 and is believed to be based in Iran. The groups primary targets are government agencies, military organizations, defense contractors, and individuals involved with the US-Iran conflict. APT39 uses a variety of tactics such as spear phishing emails, malware drops, and watering hole attacks to gain access to their target systems. The group has been linked to several high profile cyberattacks including the attack on the Saudi Arabian National Petroleum Company (SNPC) in 2017.

Techniques, tactics and practices: 

APT39 uses a variety of tactics such as spear phishing emails, malware drops, and watering hole attacks to gain access to their target systems. They also use social engineering techniques to gather information about potential targets before launching an attack. Additionally, they have been known to exploit vulnerabilities in software and operating systems to gain unauthorized access to networks.