Elfin

Elfin, also known as APT33, Peach Sandstorm, HOLMIUM, MAGNALIUM, and REFINED KITTEN, is a threat actor group that has been active since at least 2013. This group has been associated with numerous cyber-espionage activities targeting various sectors including government, defense, satellite, oil, and gas in the U.S. and UAE. From 2016 to 2019, Elfin carried out many attacks on U.S. targets, predominantly through vulnerability exploitation. Microsoft researchers have reported that this Iran-linked group used custom multi-stage backdoor malware, such as Tickler and FalseFont, to compromise organizations. Elfin's activities include high-volume password spray attacks, where attackers try one known password against a list of usernames. These campaigns, named Peach Sandstorm, targeted high-value entities for intelligence collection. One notable incident involved a Shamoon victim in Saudi Arabia who had recently been attacked by Elfin and infected with the Stonedrill malware. However, Symantec found no further evidence linking Elfin directly to these Shamoon attacks. This group has also been linked to state-sponsored advanced persistent threat (APT) groups from countries known for supporting or running cyberattacks and espionage, such as Iran, China, Russia, and North Korea. For instance, it was discovered that multiple APT groups, including Elfin, have utilized the infrastructure of service provider Cloudzy over several years. Despite its diverse naming conventions across different cybersecurity reports, Elfin remains a relentless espionage group posing significant threats to multiple organizations, particularly in Saudi Arabia and the U.S.