APT33

Threat Actor updated 2 months ago (2024-09-18T09:17:53.037Z)
Download STIX
Preview STIX
APT33, also known as Peach Sandstorm, is an Iran-linked threat actor associated with the Iranian Islamic Revolutionary Guard Corps (IRGC). This group has targeted communication equipment, government agencies, and the oil-and-gas industry in the United Arab Emirates and the United States, primarily for intelligence gathering. One of their recent activities includes targeting the Defense Industrial Base sector using a backdoor called FalseFont. Since July 2024, APT33 has been deploying a new custom multi-stage backdoor malware, 'Tickler', to compromise organizations in sectors such as government, defense, satellite, oil, and gas in the U.S. and UAE. Microsoft observed APT33 creating Azure tenants using Microsoft Outlook email accounts and setting up Azure for Students subscriptions within these tenants, indicating a sophisticated level of infiltration and manipulation of widely used software services. In September, Microsoft issued a warning about another campaign coordinated by APT33 that targeted thousands of organizations worldwide, including those in the defense sector, in extensive password spray attacks since February 2023. To mitigate the risk posed by APT33's activities, network defenders are advised to reset credentials for accounts targeted in password spray attacks, thereby reducing the attack surface exploited by APT33 hackers.
Description last updated: 2024-09-18T09:15:47.607Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Peach Sandstorm is a possible alias for APT33. Peach Sandstorm, also known as Curious Serpens, APT33, Elfin, HOLMIUM, MAGNALIUM, or REFINED KITTEN, is a threat actor linked to the Iranian Islamic Revolutionary Guard Corps (IRGC). Active since at least 2013, this espionage group has primarily targeted aerospace and energy sectors, alongside gover
6
HOLMIUM is a possible alias for APT33. Holmium, also known as Curious Serpens, Peach Sandstorm, APT33, Elfin, MAGNALIUM, or REFINED KITTEN, is a threat actor that has been active since 2013. This group is responsible for executing malicious activities with the intent of breaching security and conducting cyber espionage. The group is link
5
Refined Kitten is a possible alias for APT33. Refined Kitten, also known as APT33, Peach Sandstorm, Elfin, HOLMIUM, and MAGNALIUM, is a threat actor that has been active since at least 2013. This group is linked to Iran and specializes in cyberespionage, targeting sectors such as government, defense, satellite, oil, and gas primarily in the U.S
4
Elfin is a possible alias for APT33. Elfin, also known as APT33, Peach Sandstorm, HOLMIUM, MAGNALIUM, and REFINED KITTEN, is a threat actor group that has been active since at least 2013. This group has been associated with numerous cyber-espionage activities targeting various sectors including government, defense, satellite, oil, and
3
Magic Hound is a possible alias for APT33. Magic Hound, also known as APT33, Peach Sandstorm, Holmium, Elfin, and Refined Kitten, is an Iranian cyber-espionage group that poses a significant threat to various sectors worldwide. This threat actor has been involved in multiple malicious campaigns, leveraging different types of sophisticated ma
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Microsoft
Confluence
Exploit
Iran
Backdoor
Outlook
Espionage
Azure
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Falsefont Malware is associated with APT33. FalseFont is a new type of malware developed and used by the Iranian nation-state actor Peach Sandstorm, as observed by Microsoft. The custom backdoor malware, unveiled by Microsoft, provides its operators remote access to compromised systems, allowing for file execution and transfer to its command-Unspecified
2
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The Lazarus Group Threat Actor is associated with APT33. The Lazarus Group, a notorious threat actor linked to North Korea, is among the most prolific and dangerous cyber threat actors in operation. They have been involved in numerous cyber-attacks worldwide, with significant efforts put into their social engineering strategies. Their activities include eUnspecified
2
The APT34 Threat Actor is associated with APT33. APT34, a threat actor suspected to be linked to Iran, has been operational since at least 2014 and is involved in long-term cyber espionage operations largely focused on reconnaissance efforts. The group targets a variety of sectors including financial, government, energy, chemical, and telecommunicUnspecified
2
Associated Vulnerabilities
To see the evidence that has resulted in these vulnerability associations, create a free account
Alias DescriptionAssociation TypeVotes
The vulnerability CVE-2017-11774 is associated with APT33. Unspecified
2
Source Document References
Information about the APT33 Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
DARKReading
2 months ago
Checkpoint
2 months ago
Securityaffairs
2 months ago
Securityaffairs
2 months ago
Securityaffairs
3 months ago
Securityaffairs
3 months ago
CERT-EU
a year ago
Securityaffairs
4 months ago
Securityaffairs
4 months ago
Securityaffairs
4 months ago
Securityaffairs
4 months ago
Securityaffairs
4 months ago
Securityaffairs
5 months ago
Securityaffairs
5 months ago
Securityaffairs
5 months ago
Securityaffairs
6 months ago
Securityaffairs
6 months ago
Securityaffairs
7 months ago
Securityaffairs
7 months ago
Securityaffairs
7 months ago