APT33

Threat Actors · APT33

· ATT&CK GroupG0064

HOLMIUMElfinPeach Sandstorm

Techniques

Software

Tactics

Aliases

Description

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)

Tactic Coverage

credential access (9)execution (6)privilege escalation (6)persistence (5)command and control (5)initial access (4)stealth (3)discovery (1)exfiltration (1)collection (1)resource development (1)

Techniques Used (31)

T1003.001LSASS Memory

credential access

T1003.004LSA Secrets

credential access

T1003.005Cached Domain Credentials

credential access

T1027.013Encrypted/Encoded File

stealth

T1040Network Sniffing

credential accessdiscovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 31 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (16)

S0129AutoIt backdoormalware S1134DEADWOODmalware S0363Empiretool S0349LaZagnetool S0002Mimikatztool S0198NETWIREmalware S0336NanoCoremalware S0039Net

References (10)

https://attack.mitre.org/groups/G0064 https://www.brighttalk.com/webcast/10703/275683 https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage