APT33
- ID
- G0064
- Associated names
- HOLMIUM, Elfin, Peach Sandstorm
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]
Techniques used (31)
- T1003.001 LSASS Memory
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1027.013 Encrypted/Encoded File
- T1040 Network Sniffing
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1068 Exploitation for Privilege Escalation
- T1071.001 Web Protocols
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1105 Ingress Tool Transfer
- T1110.003 Password Spraying
- T1132.001 Standard Encoding
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1546.003 Windows Management Instrumentation Event Subscription
- T1547.001 Registry Run Keys / Startup Folder
- T1552.001 Credentials In Files
- T1552.006 Group Policy Preferences
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography
- T1588.002 Tool
Software used (16)
- S0002 Mimikatz
- S0039 Net
- S0095 ftp
- S0129 AutoIt backdoor
- S0192 Pupy
- S0194 PowerSploit
- S0198 NETWIRE
- S0199 TURNEDUP
- S0336 NanoCore
- S0349 LaZagne
- S0358 Ruler
- S0363 Empire
- S0371 POWERTON
- S0378 PoshC2
- S0380 StoneDrill
- S1134 DEADWOOD