APT33
Also known as APT 33, Elfin, MAGNALLIUM, Refined Kitten, HOLMIUM, COBALT TRINITY, G0064, ATK35, Peach Sandstorm, TA451, BLEAK ION
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess APT33 works at the behest of the Iranian government.
Targets: Private sector, United States, Saudi Arabia, South Korea
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T0852 Screen CaptureT0865 Spearphishing AttachmentT1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1027.013 Encrypted/Encoded FileT1040 Network SniffingT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1068 Exploitation for Privilege EscalationT1071.001 Web ProtocolsT1078 Valid AccountsT1078.004 Cloud AccountsT1105 Ingress Tool TransferT1110.003 Password SprayingT1132.001 Standard EncodingT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup FolderT1552.001 Credentials In FilesT1552.006 Group Policy PreferencesT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1560.001 Archive via UtilityT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1571 Non-Standard PortT1573.001 Symmetric CryptographyT1588.002 ToolT1701.001 PowerShell
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
- https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-a-dozen-obfuscated-apt33-botnets-used-for-extreme-narrow-targeting/
- https://www.brighttalk.com/webcast/10703/275683
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity
- https://attack.mitre.org/groups/G0064/
- https://threatconnect.com/blog/research-roundup-activity-on-previously-identified-apt33-domains/
- https://www.cfr.org/interactive/cyber-operations/apt-33
- https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
- https://dragos.com/adversaries.html
- https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/
- https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.