APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.12
- FireEye APT33 Sept 2017
- FireEye APT33 Webinar Sept 2017
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | APT33 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | HOLMIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Elfin | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Peach Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.004 | LSA Secrets | — |
| T1003.005 | Cached Domain Credentials | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1040 | Network Sniffing | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1053.005 | Scheduled Task | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1071.001 | Web Protocols | — |
| T1078 | Valid Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.003 | Password Spraying | — |
| T1132.001 | Standard Encoding | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1546.003 | Windows Management Instrumentation Event Subscription | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.001 | Credentials In Files | — |
| T1552.006 | Group Policy Preferences | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1571 | Non-Standard Port | — |
| T1573.001 | Symmetric Cryptography | — |
| T1588.002 | Tool | — |
Aliases
APT33 · Elfin · HOLMIUM · Peach Sandstorm
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.