APT33
APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.
- ATT&CK ID
- G0064
- Origin
- Iran
- Weather family
- Sandstorm
- Techniques
- 23
- Tools
- 16
Also tracked as HOLMIUM · Elfin · Peach Sandstorm
Vulnerabilities it has exploited
- CVE-2017-0213 Microsoft WindowsUnscored · exploited in the wild
- CVE-2017-11774 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-20250 RARLAB WinRARUnscored · exploited in the wild
Techniques
Resource Development
Initial Access
Execution
Scheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser Execution
Persistence
Scheduled Task/JobValid AccountsEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobExploitation for Privilege EscalationValid AccountsEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationValid Accounts
Credential Access
OS Credential DumpingNetwork SniffingBrute ForceUnsecured CredentialsCredentials from Password Stores
Discovery
Collection
Command and Control
Application Layer ProtocolIngress Tool TransferData EncodingNon-Standard PortEncrypted Channel
Exfiltration
Exfiltration Over Alternative Protocol
Software
AutoIt backdoor · DEADWOOD · Empire · LaZagne · Mimikatz · NETWIRE · NanoCore · Net · POWERTON · PoshC2 · PowerSploit · Pupy · Ruler · StoneDrill · TURNEDUP · ftp