Threat Actors APT33

APT33

G0064 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: HOLMIUM, Elfin, Peach Sandstorm, APT 33, MAGNALLIUM, Refined Kitten, COBALT TRINITY, G0064, ATK35, TA451, BLEAK ION, tracked as, the United States, ALFASHELL

Description

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)

Goals & Targeting

Targeted Sectors

Energy

Aerospace

Defense

Government

Aviation

Financial services

Telecommunications

Oil gas

Transportation

Non profit

Healthcare

Education

Manufacturing

Media

Targeted Countries / Regions

AI Analysis

· 1 week ago

Executive Summary

APT33 (HOLMIUM, Elfin, Peach Sandstorm) is a suspected Iranian state-sponsored cyber-espionage group targeting sectors like aviation and energy in countries such as the U.S., Saudi Arabia, and South Korea since at least 2013. The group employs various TTPs including spear-phishing, tools like NanoCore and POWERTON, and techniques such as web protocol exploitation.

Goals & Targeting

APT33 targets critical infrastructure sectors such as aviation and energy for intelligence gathering likely linked to geopolitical interests. Their focus includes the U.S., Saudi Arabia, and South Korea, suggesting strategic alignment with potential state-level objectives

Enhanced Description

APT33 is a high-sophistication cyber threat group believed to be linked to Iran. Their primary campaign activities have focused on stealing sensitive information from critical infrastructure sectors. The grpup has demonstrated adaptability through the use of a variety of tools and techniques, including custom malware development and persistent lateral movement within networks. They operate with a clear targeting strategy, focusing on specific industries and geographies that align with strategic espionage goals.

Key Capabilities

Spear-phishing campaigns
Custom malware development (NanoCore, POWERTON)
Lateral movement within networks
Persistence mechanisms

MITRE ATT&CK Tactics

Initial Access

Execution

Credential Access

Defense Evasion

ATT&CK Techniques

T1053.005

T1560.001

T1132.001

T1003.004

T1573.001

T1204.002

T1588.002

T1566.002

Software / Tooling

StoneDrill

POWERTON

DEADWOOD

Netwire

NanoCore

Campaigns & Victims

APT33 has conducted multiple campaigns since at least 2013, focusing on stealing sensitive information from critical sectors. Campaigns have involved spear-phishing with malicious links and attachments targeting employees in the aviation and energy industries.

IOC Patterns

Spear-phishing emails with malicious attachments
Scheduled task creation for persistence
Use of custom malware families like POWERTON

Recommended Actions

Implement network monitoring for known APT33 TTPs
Conduct regular user training on spear-phishing attacks
Enhance segmentation and micro-segmentation in critical systems

Suggested Tags

APT

espionage

critical-infrastructure

Confidence Assessment

High confidence in APT33's operational tactics and targeted sectors based on multiple reports. Limited specifics on exact campaigns or toolsets used beyond known TTPs and tools.

ATT&CK Techniques

Collection

3 techniques

T1113

Screen Capture

T1560

Archive Collected Data

T1560.001

Archive via Utility

APT33 has used WinRAR to compress data prior to exfil.(Citation: Symantec Elfin Mar 2019)

Command & Control

8 techniques

T1071

Application Layer Protocol

T1071.001

Web Protocols

APT33 has used HTTP for command and control.(Citation: Symantec Elfin Mar 2019)

T1105

Ingress Tool Transfer

APT33 has downloaded additional files and programs from its C2 server.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)

T1132

Data Encoding

T1132.001

Standard Encoding

APT33 has used base64 to encode command and control traffic.(Citation: FireEye APT33 Guardrail)

T1571

Non-Standard Port

APT33 has used HTTP over TCP ports 808 and 880 for command and control.(Citation: Symantec Elfin Mar 2019)

T1573

Encrypted Channel

T1573.001

Symmetric Cryptography

APT33 has used AES for encryption of command and control traffic.(Citation: FireEye APT33 Guardrail)

Credential Access

12 techniques

T1003

OS Credential Dumping

T1003.001

LSASS Memory

APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

T1003.004

LSA Secrets

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

T1003.005

Cached Domain Credentials

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

T1040

Network Sniffing

APT33 has used SniffPass to collect credentials by sniffing network traffic.(Citation: Symantec Elfin Mar 2019)

T1110

Brute Force

T1110.003

Password Spraying

APT33 has used password spraying to gain access to target systems.(Citation: FireEye APT33 Guardrail)(Citation: Microsoft Holmium June 2020)

T1552

Unsecured Credentials

T1552.001

Credentials In Files

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

T1552.006

Group Policy Preferences

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

T1555

Credentials from Password Stores

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

T1555.003

Credentials from Web Browsers

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)

Discovery

1 technique

T1082

System Information Discovery

Execution

9 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

APT33 has created a scheduled task to execute a .vbe file multiple times a day.(Citation: Symantec Elfin Mar 2019)

T1059

Command and Scripting Interpreter

T1059.001

PowerShell

APT33 has utilized PowerShell to download files from the C2 server and run various scripts. (Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)

T1059.005

Visual Basic

APT33 has used VBScript to initiate the delivery of payloads.(Citation: Microsoft Holmium June 2020)

T1203

Exploitation for Client Execution

APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)

T1204

User Execution

T1204.001

Malicious Link

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.(Citation: FireEye APT33 Sept 2017)(Citation: Symantec Elfin Mar 2019)

T1204.002

Malicious File

APT33 has used malicious e-mail attachments to lure victims into executing malware.(Citation: Microsoft Holmium June 2020)

Exfiltration

2 techniques

T1048

Exfiltration Over Alternative Protocol

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol

APT33 has used FTP to exfiltrate files (separately from the C2 channel).(Citation: Symantec Elfin Mar 2019)

Initial Access

3 techniques

T1566

Phishing

T1566.001

Spearphishing Attachment

APT33 has sent spearphishing e-mails with archive attachments.(Citation: Microsoft Holmium June 2020)

T1566.002

Spearphishing Link

APT33 has sent spearphishing emails containing links to .hta files.(Citation: FireEye APT33 Sept 2017)(Citation: Symantec Elfin Mar 2019)

Persistence

2 techniques

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)

Privilege Escalation

3 techniques

T1068

Exploitation for Privilege Escalation

APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.(Citation: FireEye APT33 Guardrail)

T1546

Event Triggered Execution

T1546.003

Windows Management Instrumentation Event Subscription

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.(Citation: Microsoft Holmium June 2020)

Resource Development

2 techniques

T1588

Obtain Capabilities

T1588.002

Tool

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.(Citation: FireEye APT33 Guardrail)(Citation: Symantec Elfin Mar 2019)

Stealth

5 techniques

T1027

Obfuscated Files or Information

T1027.013

Encrypted/Encoded File

APT33 has used base64 to encode payloads.(Citation: FireEye APT33 Guardrail)

T1055

Process Injection

T1078

Valid Accounts

APT33 has used valid accounts for initial access and privilege escalation.(Citation: FireEye APT33 Webinar Sept 2017)(Citation: FireEye APT33 Guardrail)

T1078.004

Cloud Accounts

APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.(Citation: Microsoft Holmium June 2020)

3 techniques

T0852

T0853

T0865