APT33 — APT Profile
APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM, Refined Kitten, COBALT TRINITY, G0064, ATK35, TA451, BLEAK ION
IntelFusions coverage (1)
- APT33: Iran's IRGC-Linked Espionage Group Targets Aviation, Energy, and Defense Across Three Continents 2026-02-16 · Nation-State
Tools & malware
- AutoIt backdoor Backdoor
- DEADWOOD Wiper
- Empire Post-Exploitation Framework
- ftp Exfiltration
- LaZagne Credential Harvesting
- Mimikatz Credential Harvesting
- NanoCore Remote Access Trojan
- Net Network Reconnaissance
- NETWIRE Remote Access Trojan
- PoshC2 Post-Exploitation Framework
- PowerSploit Post-Exploitation Framework
- POWERTON Backdoor
- ps1.powerton Backdoor
- Pupy Remote Access Trojan
- Ruler Phishing Framework
- StoneDrill Wiper
- TURNEDUP Backdoor
- win.darkcomet Backdoor
- win.dropshot Backdoor
- win.filerase Backdoor
- win.nanocore Backdoor
- win.netwire Backdoor
- win.poshc2 POS Malware
- win.powerband Backdoor
- win.pupy Backdoor
- win.quasar_rat Remote Access Trojan
- win.remcos Backdoor
- win.shapeshift Backdoor
- win.turnedup Backdoor
Vendor research
- Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware O'Leary, J., et al
- How Microsoft names threat actors Microsoft
- APT33: New Insights into Iranian Cyber Espionage Group FireEye
- Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint Microsoft
- Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S Symantec
- Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware FireEye
Countries linked to this actor
- Iran origin
- Saudi Arabia targets