apt33-elfin

# APT33 (Elfin, Peach Sandstorm, HOLMIUM) — Adversary Emulation Profile APT33 (MITRE ATT&CK **G0064**; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from `.hta`-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked — with varying confidence — to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope. ## Attribution & motivation - **Suspected sponsor / nation:** Iran. FireEye/Mandiant assessed APT33 works at the behest of the Iranian government and reported evidence linking the group to the Nasr Institute, an Iranian organization associated with cyber-warfare operations. Microsoft tracks the same actor as **Peach Sandstorm** and likewise attributes it to Iranian state interests. - **Primary motivation:** Strategic **espionage / intelligence collection** aligned with Iranian state interests (aerospace, defense, energy). Microsoft assessed the 2023 password-spray campaign was likely intended to facilitate intelligence collection supporting Iranian state objectives. - **Secondary / destructive dimension:** APT33 has been *linked* to the **StoneDrill** wiper, which shares similarities with the Shamoon family used against Saudi Aramco and RasGas (2012). Confidence on the destructive link is **lower than the espionage attribution** — Kaspersky and FireEye both noted it is unproven whether the Shamoon and StoneDrill operators are the same group or merely aligned in interests/region. Treat any destructive capability claim as plausible-but-unconfirmed. - **Attribution confidence:** Moderate-to-high for Iranian state-sponsored espionage (multiple independent vendors converge: FireEye/Mandiant, Symantec, Microsoft). Lower for the destructive/wiper attribution. ## Targeting - **Sectors:** Aviation (both military and commercial), energy with ties to petrochemical production (Mandiant 2017); chemical, engineering, manufacturing, consulting, finance, telecoms, research, and government (Symantec 2019). More recently: **satellite, defense, the Defense Industrial Base (DIB), pharmaceutical, communications, oil & gas, and government** (Microsoft 2023–2024). - **Regions:** Historically concentrated on **Saudi Arabia** (Symantec attributed ~42% of observed Elfin attacks since 2016) and the **United States** (including Fortune 500 firms), plus **South Korea**. Recent Peach Sandstorm campaigns are global, including the U.S. and UAE. - **Victim profile:** Organizations of strategic interest to Iran — aerospace/defense contractors and supply-chain subcontractors, energy/petrochemical operators, and satellite/communications providers. Spearphishing has often targeted individuals in aviation-related roles using recruitment/job-themed lures. ## Notable campaigns - **2016–mid 2017 — Aviation & petrochemical intrusions.** APT33 compromised a U.S. aviation organization and targeted a Saudi business conglomerate with aviation holdings and a South Korean oil-refining/petrochemical company; May 2017 lures impersonated job vacancies at a Saudi petrochemical firm. (FireEye/Mandiant, "APT33: Insights into Iranian Cyber Espionage," Sept 2017.) - **2017 — StoneDrill wiper discovery.** Kaspersky disclosed StoneDrill, a destructive wiper found in campaigns against Middle Eastern and European targets and linked to APT33-aligned activity, with conceptual similarities to Shamoon. (Kaspersky/Securelist, "From Shamoon to StoneDrill," 2017.) - **Feb 2019 — Elfin / WinRAR exploitation.** Symantec reported the Elfin (APT33) group attacked ~50 organizations across Saudi Arabia, the U.S., and other countries, and attempted to exploit **CVE-2018-20250** (WinRAR ACE) against a Saudi chemical-sector target. (Symantec, "Elfin: Relentless Espionage Group," Mar 2019.) - **Feb–Jul 2023 — Peach Sandstorm password-spray.** Microsoft observed large-scale password-spray authentication attempts against thousands of organizations in satellite, defense, and pharmaceutical sectors, followed by Entra ID reconnaissance with AzureHound/Roadtools on successful compromises. (Microsoft, "Peach Sandstorm password spray campaigns," Sept 14 2023.) - **Nov–Dec 2023 — FalseFont backdoor against the DIB.** Microsoft observed Peach Sandstorm delivering the custom **FalseFont** backdoor to Defense Industrial Base organizations, enabling remote access, file launch, and C2 exfiltration. (Microsoft / The Hacker News / BleepingComputer, Dec 2023.) - **Apr–Jul 2024 — Tickler malware & Azure abuse.** Microsoft reported Peach Sandstorm deploying the custom multi-stage **Tickler** backdoor against satellite, communications, oil & gas, and U.S./UAE government targets, using fraudulent Azure subscriptions (compromised education-sector accounts) for Azure App Service C2 nodes, plus LinkedIn social engineering and SMB lateral movement. (Microsoft, "Peach Sandstorm deploys new custom Tickler malware," Aug 28 2024.) ## TTPs by ATT&CK tactic **Initial Access** - `T1566.001` — Spearphishing Attachment: archive attachments delivered in spearphishing emails. - `T1566.002` — Spearphishing Link: emails linking to malicious `.hta` HTML application files (recruitment/job lures). - `T1110.003` — Password Spraying: large-scale spray against cloud/Internet-facing auth to gain initial footholds (Peach Sandstorm 2023, low-and-slow with `go-http-client` UA). - `T1078` / `T1078.004` — Valid Accounts (incl. Cloud Accounts): use of compromised credentials, including Office 365 / Microsoft 365 accounts (historically with the Ruler tool). - `T1203` — Exploitation for Client Execution: WinRAR `CVE-2018-20250` and Outlook `CVE-2017-11774`. **Execution** - `T1059.001` — PowerShell: download payloads from C2 and run scripts. - `T1059.005` — Visual Basic: VBScript to initiate payload delivery. - `T1204.001` / `T1204.002` — User Execution (Malicious Link / Malicious File): luring users to click `.hta` links or open malicious attachments. **Persistence** - `T1547.001` — Registry Run Keys: used for DarkComet-style autostart persistence. - `T1546.003` — WMI Event Subscription: WMI subscriptions for persistence. - `T1053.005` — Scheduled Task: `.vbe` execution scheduled to run multiple times per day. **Privilege Escalation** - `T1068` — Exploitation for Privilege Escalation: `CVE-2017-0213`. - `T1078` — Valid Accounts also leveraged to operate at elevated/legitimate privilege. **Defense Evasion** - `T1132.001` — Standard Encoding: Base64-encoded C2 traffic. - `T1027.013` — Obfuscated/Encoded File: Base64-encoded payloads. - (2024 Tickler) DLL sideloading via legitimate Windows binaries to blend persistence with trusted processes. **Credential Access** - `T1003.001` — LSASS Memory: LaZagne, Mimikatz, and ProcDump. - `T1003.004` — LSA Secrets: LaZagne. - `T1003.005` — Cached Domain Credentials: LaZagne. - `T1555` / `T1555.003` — Credentials from Password Stores / Web Browsers: LaZagne. - `T1040` — Network Sniffing: SniffPass for credential capture. - `T1552.001` — Credentials In Files: LaZagne file-based credential discovery. - `T1552.006` — Group Policy Preferences: Gpppassword to recover GPP-stored credentials. **Discovery** - Active Directory and Microsoft Entra ID reconnaissance: AzureHound (via Microsoft Graph / Azure REST APIs) and Roadtools against cloud tenants after successful auth; AD snapshot extraction on-prem. **Lateral Movement** - SMB-based propagation across the network following initial compromise (Peach Sandstorm 2024); attempted deployment of AnyDesk remote management for access. **Collection** - `T1560.001` — Archive via Utility: WinRAR to compress data prior to exfiltration. - `T0852` (ICS) — Screen Capture: backdoor screenshot capability. **Command and Control** - `T1071.001` — Web Protocols: HTTP for C2. - `T1573.001` — Symmetric Cryptography: AES-encrypted C2 channel. - `T1571` — Non-Standard Port: HTTP over TCP ports 808 and 880. - `T1105` — Ingress Tool Transfer: download additional files/programs from C2. - (2024) Azure App Service apps (e.g., `*.azurewebsites.net`) as C2 nodes under fraudulent Azure subscriptions. **Exfiltration** - `T1048.003` — Exfiltration Over Alternative Protocol: FTP for file exfiltration separate from the C2 channel. **Impact** - StoneDrill (`S0380`) wiper capability — destructive disk-wiping linked to APT33-aligned activity (attribution lower-confidence; conceptually related to Shamoon). **Resource Development / ICS-adjacent** - `T1588.002` — Obtain Capabilities (Tool): acquisition of publicly available offensive tools. - `T0853` (ICS) — Scripting: PowerShell for C2 and file installation. - `T0865` (ICS) — Spearphishing Attachment: `.hta` files with embedded malicious code. ## Signature tooling & malware Custom families: **TURNEDUP** (`S0198`/backdoor — RAT, `S0199`), **NanoCore** (`S0336`), **NETWIRE** (`S0198`), **POWERTON** (`S0371`, PowerShell backdoor), **PoshC2** (`S0378`), **AutoIt backdoor** (`S0129`), **DEADWOOD** (`S1134`, 2019), **StoneDrill** (`S0380`, wiper), plus newer custom backdoors **FalseFont** (2023, DIB) and **Tickler** (2024, multi-stage Azure-backed). Publicly available / dual-use: **Mimikatz** (`S0002`), **LaZagne** (`S0349`), **PowerSploit** (`S0194`), **Empire** (`S0363`), **Pupy** (`S0192`), **Ruler** (`S0358`, Outlook/O365), **ftp** (`S0095`), **Net** (`S0039`), **ProcDump**, **SniffPass**, **Gpppassword**, **AzureHound**, **Roadtools**, and **AnyDesk** (abused RMM). ## Emulation guidance (Decepticon) > Authorized-use only: execute these emulations strictly within the engagement's written scope, target list, and rules of engagement. Destructive/wiper TTPs must NEVER be executed against client systems — emulate Impact only via documented, reversible markers or out-of-scope-by-default. Map APT33's signature chain to Decepticon's own capabilities: - **Initial access — password spray (`T1110.003`) + cloud valid accounts (`T1078.004`):** This is the modern APT33 signature. Use Decepticon's cloud skills to run a low-and-slow spray against the engagement's M365/Entra ID tenant with a custom user-agent and lockout-aware throttling, mirroring the `go-http-client` low-volume pattern. Pair with the engagement's authorized credential list. Avoid lockouts to stay in scope. - **Initial access — spearphishing (`T1566.001/.002`, `T1204`):** If phishing is in scope, emulate `.hta`/archive-attachment lures with recruitment/job themes via the engagement's sanctioned phishing harness; otherwise simulate the post-delivery effect by assuming a foothold. - **Execution / staging (`T1059.001`, `T1105`):** Use Decepticon's bash/PowerShell tooling to fetch and run a stager from your redirector, mirroring PowerShell download-and-execute. - **C2 — emulate with Sliver:** Stand up a Sliver HTTP listener (matches `T1071.001`), enable symmetric-crypto transport (`T1573.001`), and bind to non-standard ports analogous to 808/880 (`T1571`). For high-fidelity cloud emulation, front C2 through an authorized Azure App Service / `*.azurewebsites.net` redirector to replicate the Tickler infrastructure pattern — only with cloud-team approval. - **Cloud/AD discovery (`AzureHound`/`Roadtools`/AD snapshot):** Use Decepticon's cloud and AD skills to enumerate Entra ID via Graph/Azure REST (AzureHound-style) and pull an AD snapshot/BloodHound collection on-prem — the exact recon APT33 runs post-auth. - **Credential access (`T1003.001/.004/.005`, `T1555`, `T1552.006`):** Via the defense-evasion / credential workflow, emulate LSASS dumping (Mimikatz/ProcDump-style), LaZagne-style store harvesting, and GPP password recovery — log every artifact for the blue cell. - **Lateral movement (`T1078`, SMB):** Use Decepticon's lateral-movement skill for SMB-based propagation with recovered valid accounts; optionally emulate AnyDesk RMM deployment if RMM abuse is in scope. - **Collection & exfil (`T1560.001`, `T1048.003`):** Archive staged data with a WinRAR-equivalent utility, then exfiltrate over a *separate* FTP channel distinct from C2 to reproduce APT33's split-channel pattern. - **Defense evasion (`T1132.001`, `T1027.013`, DLL sideloading):** Base64-encode tasking/payloads and emulate DLL sideloading against a benign legitimate binary to test the blue cell's sideload detection. - **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Plant a Run-key, a WMI event subscription, and a recurring scheduled task (multiple daily triggers) as APT33 does — document each for clean teardown. ## Detection & defense - **Password spray / cloud identity (`T1110.003`, `T1078.004`):** Enforce phishing-resistant MFA, conditional access, and risk-based sign-in policies; alert on high-volume failed auth from single/few source IPs, anomalous user-agents (e.g., `go-http-client`), and impossible-travel. Monitor for fraudulent Azure subscription creation and unexpected Azure App Service deployments. - **Spearphishing / `.hta` (`T1566`, `T1204`):** Block/inspect `.hta` and archive attachments at the gateway; disable `mshta.exe` where feasible; user-awareness on recruitment-themed lures. - **Exploits (`T1203`, `T1068`):** Patch WinRAR (CVE-2018-20250), Outlook (CVE-2017-11774), and Windows (CVE-2017-0213); restrict legacy archive utilities. - **Cloud/AD recon (AzureHound/Roadtools):** Monitor Microsoft Graph / Azure REST enumeration spikes from newly authenticated principals; alert on bulk directory reads and AD snapshot/`ntds`-style access. - **Credential access (`T1003.x`):** Enable LSASS protection (PPL/Credential Guard), alert on ProcDump/Mimikatz LSASS handle access, and remediate GPP passwords (KB2962486). - **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Baseline Run keys, WMI event subscriptions, and scheduled tasks; alert on `.vbe`/`.hta`-spawned task creation. - **C2 / exfil (`T1071.001`, `T1571`, `T1573.001`, `T1048.003`):** Inspect HTTP on non-standard ports (808/880), flag long-lived beaconing to `*.azurewebsites.net` not tied to business use, and alert on outbound FTP to non-approved hosts. - **Lateral movement / RMM:** Detect anomalous SMB admin-share writes and unauthorized AnyDesk/RMM installation. - **Impact (wiper):** Maintain tested offline backups and EDR rules for mass file overwrite / MBR tampering given the StoneDrill/Shamoon-adjacent risk. ## Sources - https://attack.mitre.org/groups/G0064/ - https://www.mandiant.com/resources/blog/apt33-insights-into-iranian-cyber-espionage - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/elfin-apt33-espionage - https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/ - https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations/ - https://thehackernews.com/2023/12/microsoft-warns-of-new-falsefont.html - https://www.bleepingcomputer.com/news/security/microsoft-hackers-target-defense-firms-with-new-falsefont-malware/ - https://securelist.com/from-shamoon-to-stonedrill/77725/ - https://attack.mitre.org/software/S0380/