apt33-elfin

name	apt33-elfin
description	Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, Iranian APT, G0064, aviation, energy, petrochemical, defense industrial base, satellite, password spray, FalseFont, Tickler, StoneDrill, Shamoon, .hta spearphishing, Azure abuse, AzureHound, Roadtools, WinRAR CVE-2018-20250, emulate Iranian espionage actor","tags":"adversary-emulation, threat-intel, mitre-attack, apt33, iran, espionage, peach-sandstorm, password-spray, cloud, red-team","mitre_attack":"T1071.001, T1560.001, T1547.001, T1110.003, T1059.001, T1059.005, T1555, T1555.003, T1132.001, T1573.001, T1546.003, T1048.003, T1203, T1068, T1105, T1040, T1571, T1027.013, T1588.002, T1003.001, T1003.004, T1003.005, T1566.001, T1566.002, T1053.005, T1552.001, T1552.006, T1204.001, T1204.002, T1078, T1078.004, T0852, T0853, T0865"}

APT33 (Elfin, Peach Sandstorm, HOLMIUM) — Adversary Emulation Profile

APT33 (MITRE ATT&CK G0064; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from .hta-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked — with varying confidence — to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.

Attribution & motivation

• Suspected sponsor / nation: Iran. FireEye/Mandiant assessed APT33 works at the behest of the Iranian government and reported evidence linking the group to the Nasr Institute, an Iranian organization associated with cyber-warfare operations. Microsoft tracks the same actor as Peach Sandstorm and likewise attributes it to Iranian state interests.
• Primary motivation: Strategic espionage / intelligence collection aligned with Iranian state interests (aerospace, defense, energy). Microsoft assessed the 2023 password-spray campaign was likely intended to facilitate intelligence collection supporting Iranian state objectives.
• Secondary / destructive dimension: APT33 has been linked to the StoneDrill wiper, which shares similarities with the Shamoon family used against Saudi Aramco and RasGas (2012). Confidence on the destructive link is lower than the espionage attribution — Kaspersky and FireEye both noted it is unproven whether the Shamoon and StoneDrill operators are the same group or merely aligned in interests/region. Treat any destructive capability claim as plausible-but-unconfirmed.
• Attribution confidence: Moderate-to-high for Iranian state-sponsored espionage (multiple independent vendors converge: FireEye/Mandiant, Symantec, Microsoft). Lower for the destructive/wiper attribution.

Targeting

• Sectors: Aviation (both military and commercial), energy with ties to petrochemical production (Mandiant 2017); chemical, engineering, manufacturing, consulting, finance, telecoms, research, and government (Symantec 2019). More recently: satellite, defense, the Defense Industrial Base (DIB), pharmaceutical, communications, oil & gas, and government (Microsoft 2023–2024).
• Regions: Historically concentrated on Saudi Arabia (Symantec attributed ~42% of observed Elfin attacks since 2016) and the United States (including Fortune 500 firms), plus South Korea. Recent Peach Sandstorm campaigns are global, including the U.S. and UAE.
• Victim profile: Organizations of strategic interest to Iran — aerospace/defense contractors and supply-chain subcontractors, energy/petrochemical operators, and satellite/communications providers. Spearphishing has often targeted individuals in aviation-related roles using recruitment/job-themed lures.

Notable campaigns

• 2016–mid 2017 — Aviation & petrochemical intrusions. APT33 compromised a U.S. aviation organization and targeted a Saudi business conglomerate with aviation holdings and a South Korean oil-refining/petrochemical company; May 2017 lures impersonated job vacancies at a Saudi petrochemical firm. (FireEye/Mandiant, "APT33: Insights into Iranian Cyber Espionage," Sept 2017.)
• 2017 — StoneDrill wiper discovery. Kaspersky disclosed StoneDrill, a destructive wiper found in campaigns against Middle Eastern and European targets and linked to APT33-aligned activity, with conceptual similarities to Shamoon. (Kaspersky/Securelist, "From Shamoon to StoneDrill," 2017.)
• Feb 2019 — Elfin / WinRAR exploitation. Symantec reported the Elfin (APT33) group attacked ~50 organizations across Saudi Arabia, the U.S., and other countries, and attempted to exploit CVE-2018-20250 (WinRAR ACE) against a Saudi chemical-sector target. (Symantec, "Elfin: Relentless Espionage Group," Mar 2019.)
• Feb–Jul 2023 — Peach Sandstorm password-spray. Microsoft observed large-scale password-spray authentication attempts against thousands of organizations in satellite, defense, and pharmaceutical sectors, followed by Entra ID reconnaissance with AzureHound/Roadtools on successful compromises. (Microsoft, "Peach Sandstorm password spray campaigns," Sept 14 2023.)
• Nov–Dec 2023 — FalseFont backdoor against the DIB. Microsoft observed Peach Sandstorm delivering the custom FalseFont backdoor to Defense Industrial Base organizations, enabling remote access, file launch, and C2 exfiltration. (Microsoft / The Hacker News / BleepingComputer, Dec 2023.)
• Apr–Jul 2024 — Tickler malware & Azure abuse. Microsoft reported Peach Sandstorm deploying the custom multi-stage Tickler backdoor against satellite, communications, oil & gas, and U.S./UAE government targets, using fraudulent Azure subscriptions (compromised education-sector accounts) for Azure App Service C2 nodes, plus LinkedIn social engineering and SMB lateral movement. (Microsoft, "Peach Sandstorm deploys new custom Tickler malware," Aug 28 2024.)

TTPs by ATT&CK tactic

Initial Access

• T1566.001 — Spearphishing Attachment: archive attachments delivered in spearphishing emails.
• T1566.002 — Spearphishing Link: emails linking to malicious .hta HTML application files (recruitment/job lures).
• T1110.003 — Password Spraying: large-scale spray against cloud/Internet-facing auth to gain initial footholds (Peach Sandstorm 2023, low-and-slow with go-http-client UA).
• T1078 / T1078.004 — Valid Accounts (incl. Cloud Accounts): use of compromised credentials, including Office 365 / Microsoft 365 accounts (historically with the Ruler tool).
• T1203 — Exploitation for Client Execution: WinRAR CVE-2018-20250 and Outlook CVE-2017-11774.

Execution

• T1059.001 — PowerShell: download payloads from C2 and run scripts.
• T1059.005 — Visual Basic: VBScript to initiate payload delivery.
• T1204.001 / T1204.002 — User Execution (Malicious Link / Malicious File): luring users to click .hta links or open malicious attachments.

Persistence

• T1547.001 — Registry Run Keys: used for DarkComet-style autostart persistence.
• T1546.003 — WMI Event Subscription: WMI subscriptions for persistence.
• T1053.005 — Scheduled Task: .vbe execution scheduled to run multiple times per day.

Privilege Escalation

• T1068 — Exploitation for Privilege Escalation: CVE-2017-0213.
• T1078 — Valid Accounts also leveraged to operate at elevated/legitimate privilege.

Defense Evasion

• T1132.001 — Standard Encoding: Base64-encoded C2 traffic.
• T1027.013 — Obfuscated/Encoded File: Base64-encoded payloads.
• (2024 Tickler) DLL sideloading via legitimate Windows binaries to blend persistence with trusted processes.

Credential Access

• T1003.001 — LSASS Memory: LaZagne, Mimikatz, and ProcDump.
• T1003.004 — LSA Secrets: LaZagne.
• T1003.005 — Cached Domain Credentials: LaZagne.
• T1555 / T1555.003 — Credentials from Password Stores / Web Browsers: LaZagne.
• T1040 — Network Sniffing: SniffPass for credential capture.
• T1552.001 — Credentials In Files: LaZagne file-based credential discovery.
• T1552.006 — Group Policy Preferences: Gpppassword to recover GPP-stored credentials.

Discovery

• Active Directory and Microsoft Entra ID reconnaissance: AzureHound (via Microsoft Graph / Azure REST APIs) and Roadtools against cloud tenants after successful auth; AD snapshot extraction on-prem.

Lateral Movement

• SMB-based propagation across the network following initial compromise (Peach Sandstorm 2024); attempted deployment of AnyDesk remote management for access.

Collection

• T1560.001 — Archive via Utility: WinRAR to compress data prior to exfiltration.
• T0852 (ICS) — Screen Capture: backdoor screenshot capability.

Command and Control

• T1071.001 — Web Protocols: HTTP for C2.
• T1573.001 — Symmetric Cryptography: AES-encrypted C2 channel.
• T1571 — Non-Standard Port: HTTP over TCP ports 808 and 880.
• T1105 — Ingress Tool Transfer: download additional files/programs from C2.
• (2024) Azure App Service apps (e.g., *.azurewebsites.net) as C2 nodes under fraudulent Azure subscriptions.

Exfiltration

• T1048.003 — Exfiltration Over Alternative Protocol: FTP for file exfiltration separate from the C2 channel.

Impact

• StoneDrill (S0380) wiper capability — destructive disk-wiping linked to APT33-aligned activity (attribution lower-confidence; conceptually related to Shamoon).

Resource Development / ICS-adjacent

• T1588.002 — Obtain Capabilities (Tool): acquisition of publicly available offensive tools.
• T0853 (ICS) — Scripting: PowerShell for C2 and file installation.
• T0865 (ICS) — Spearphishing Attachment: .hta files with embedded malicious code.

Signature tooling & malware

Custom families: TURNEDUP (S0198/backdoor — RAT, S0199), NanoCore (S0336), NETWIRE (S0198), POWERTON (S0371, PowerShell backdoor), PoshC2 (S0378), AutoIt backdoor (S0129), DEADWOOD (S1134, 2019), StoneDrill (S0380, wiper), plus newer custom backdoors FalseFont (2023, DIB) and Tickler (2024, multi-stage Azure-backed).

Publicly available / dual-use: Mimikatz (S0002), LaZagne (S0349), PowerSploit (S0194), Empire (S0363), Pupy (S0192), Ruler (S0358, Outlook/O365), ftp (S0095), Net (S0039), ProcDump, SniffPass, Gpppassword, AzureHound, Roadtools, and AnyDesk (abused RMM).

Emulation guidance (Decepticon)

Authorized-use only: execute these emulations strictly within the engagement's written scope, target list, and rules of engagement. Destructive/wiper TTPs must NEVER be executed against client systems — emulate Impact only via documented, reversible markers or out-of-scope-by-default.

Map APT33's signature chain to Decepticon's own capabilities:

• Initial access — password spray (T1110.003) + cloud valid accounts (T1078.004): This is the modern APT33 signature. Use Decepticon's cloud skills to run a low-and-slow spray against the engagement's M365/Entra ID tenant with a custom user-agent and lockout-aware throttling, mirroring the go-http-client low-volume pattern. Pair with the engagement's authorized credential list. Avoid lockouts to stay in scope.
• Initial access — spearphishing (T1566.001/.002, T1204): If phishing is in scope, emulate .hta/archive-attachment lures with recruitment/job themes via the engagement's sanctioned phishing harness; otherwise simulate the post-delivery effect by assuming a foothold.
• Execution / staging (T1059.001, T1105): Use Decepticon's bash/PowerShell tooling to fetch and run a stager from your redirector, mirroring PowerShell download-and-execute.
• C2 — emulate with Sliver: Stand up a Sliver HTTP listener (matches T1071.001), enable symmetric-crypto transport (T1573.001), and bind to non-standard ports analogous to 808/880 (T1571). For high-fidelity cloud emulation, front C2 through an authorized Azure App Service / *.azurewebsites.net redirector to replicate the Tickler infrastructure pattern — only with cloud-team approval.
• Cloud/AD discovery (AzureHound/Roadtools/AD snapshot): Use Decepticon's cloud and AD skills to enumerate Entra ID via Graph/Azure REST (AzureHound-style) and pull an AD snapshot/BloodHound collection on-prem — the exact recon APT33 runs post-auth.
• Credential access (T1003.001/.004/.005, T1555, T1552.006): Via the defense-evasion / credential workflow, emulate LSASS dumping (Mimikatz/ProcDump-style), LaZagne-style store harvesting, and GPP password recovery — log every artifact for the blue cell.
• Lateral movement (T1078, SMB): Use Decepticon's lateral-movement skill for SMB-based propagation with recovered valid accounts; optionally emulate AnyDesk RMM deployment if RMM abuse is in scope.
• Collection & exfil (T1560.001, T1048.003): Archive staged data with a WinRAR-equivalent utility, then exfiltrate over a separate FTP channel distinct from C2 to reproduce APT33's split-channel pattern.

Detection & defense

• Password spray / cloud identity (T1110.003, T1078.004): Enforce phishing-resistant MFA, conditional access, and risk-based sign-in policies; alert on high-volume failed auth from single/few source IPs, anomalous user-agents (e.g., go-http-client), and impossible-travel. Monitor for fraudulent Azure subscription creation and unexpected Azure App Service deployments.
• Spearphishing / .hta (T1566, T1204): Block/inspect .hta and archive attachments at the gateway; disable mshta.exe where feasible; user-awareness on recruitment-themed lures.
• Exploits (T1203, T1068): Patch WinRAR (CVE-2018-20250), Outlook (CVE-2017-11774), and Windows (CVE-2017-0213); restrict legacy archive utilities.
• Cloud/AD recon (AzureHound/Roadtools): Monitor Microsoft Graph / Azure REST enumeration spikes from newly authenticated principals; alert on bulk directory reads and AD snapshot/ntds-style access.
• Credential access (T1003.x): Enable LSASS protection (PPL/Credential Guard), alert on ProcDump/Mimikatz LSASS handle access, and remediate GPP passwords (KB2962486).
• Persistence (T1547.001, T1546.003, T1053.005): Baseline Run keys, WMI event subscriptions, and scheduled tasks; alert on .vbe/.hta-spawned task creation.
• C2 / exfil (T1071.001, T1571, T1573.001, T1048.003): Inspect HTTP on non-standard ports (808/880), flag long-lived beaconing to *.azurewebsites.net not tied to business use, and alert on outbound FTP to non-approved hosts.
• Lateral movement / RMM: Detect anomalous SMB admin-share writes and unauthorized AnyDesk/RMM installation.
• Impact (wiper): Maintain tested offline backups and EDR rules for mass file overwrite / MBR tampering given the StoneDrill/Shamoon-adjacent risk.

Sources

• https://attack.mitre.org/groups/G0064/
• https://www.mandiant.com/resources/blog/apt33-insights-into-iranian-cyber-espionage
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/elfin-apt33-espionage
• https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/
• https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations/
• https://thehackernews.com/2023/12/microsoft-warns-of-new-falsefont.html
• https://www.bleepingcomputer.com/news/security/microsoft-hackers-target-defense-firms-with-new-falsefont-malware/
• https://securelist.com/from-shamoon-to-stonedrill/77725/
• https://attack.mitre.org/software/S0380/