- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Iranian Islamic Revolutionary Guard Corps (IRGC)
- Motivation
- Espionage; Information theft and espionage; Sabotage and destruction
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0064 · 34 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0024 · apt33
IranWhat it is
APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Refined Kitten
- Mandiant
- APT 33
- Microsoft
- Peach Sandstorm
- MITRE ATT&CK
- G0064
- Proofpoint
- TA451
- Thales
- ATK35
- Other names
- APT 33, Elfin, Magnallium, ATK 35, BLEAK ION, Cobalt Trinity, Curious Serpens, Elfin, HOLMIUM, Magnallium, Yellow Orc
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- MicrosoftIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Iran, Iraq, Israel, Saudi Arabia, South Korea, United Arab Emirates, United Kingdom, United States
- Sectors
- Aviation, Defense, Education, Energy, Financial, Government, Healthcare, High-Tech, Manufacturing, Media, Oil and gas, Petrochemical, Private sector, Telecommunications
Tools
The tools and malware families the sources tie to it.
- AutoIt backdoor
- Cyber Eye RAT
- CyberGate
- DEADWOOD
- DarkComet
- DistTrack
- Empire
- EmpireProject
- FalseFont
- Filerase
- JuicyPotato
- LaZagne
- Living off the Land
- Mimikatz
- NETWIRE
- NanoCore
- NanoCore RAT
- Net
- NetWire RC
- POWERTON
- PoshC2
- PowerBand
- PowerSploit
- PsList
- Pupy
- PupyRAT
- QuasarRAT
- RemcosRAT
- Ruler
- SHAPESHIFT
- StoneDrill
- TURNEDUP
- Tickler
- ftp
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de