Elfin

Threat Actor updated 8 days ago (2024-11-29T13:51:31.967Z)
Download STIX
Preview STIX
Elfin, also known as APT33, Peach Sandstorm, HOLMIUM, MAGNALIUM, and REFINED KITTEN, is a threat actor group that has been active since at least 2013. This group has been associated with numerous cyber-espionage activities targeting various sectors including government, defense, satellite, oil, and gas in the U.S. and UAE. From 2016 to 2019, Elfin carried out many attacks on U.S. targets, predominantly through vulnerability exploitation. Microsoft researchers have reported that this Iran-linked group used custom multi-stage backdoor malware, such as Tickler and FalseFont, to compromise organizations. Elfin's activities include high-volume password spray attacks, where attackers try one known password against a list of usernames. These campaigns, named Peach Sandstorm, targeted high-value entities for intelligence collection. One notable incident involved a Shamoon victim in Saudi Arabia who had recently been attacked by Elfin and infected with the Stonedrill malware. However, Symantec found no further evidence linking Elfin directly to these Shamoon attacks. This group has also been linked to state-sponsored advanced persistent threat (APT) groups from countries known for supporting or running cyberattacks and espionage, such as Iran, China, Russia, and North Korea. For instance, it was discovered that multiple APT groups, including Elfin, have utilized the infrastructure of service provider Cloudzy over several years. Despite its diverse naming conventions across different cybersecurity reports, Elfin remains a relentless espionage group posing significant threats to multiple organizations, particularly in Saudi Arabia and the U.S.
Description last updated: 2024-08-29T11:16:25.051Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Peach Sandstorm is a possible alias for Elfin. Peach Sandstorm, also known as Curious Serpens, APT33, Elfin, HOLMIUM, MAGNALIUM, or REFINED KITTEN, is a threat actor linked to the Iranian Islamic Revolutionary Guard Corps (IRGC). Active since at least 2013, this espionage group has primarily targeted aerospace and energy sectors, alongside gover
3
APT33 is a possible alias for Elfin. APT33, also known as Peach Sandstorm, is an Iran-linked threat actor associated with the Iranian Islamic Revolutionary Guard Corps (IRGC). This group has targeted communication equipment, government agencies, and the oil-and-gas industry in the United Arab Emirates and the United States, primarily f
3
HOLMIUM is a possible alias for Elfin. Holmium, also known as Curious Serpens, Peach Sandstorm, APT33, Elfin, MAGNALIUM, or REFINED KITTEN, is a threat actor that has been active since 2013. This group is responsible for executing malicious activities with the intent of breaching security and conducting cyber espionage. The group is link
3
Refined Kitten is a possible alias for Elfin. Refined Kitten, also known as APT33, Peach Sandstorm, Elfin, HOLMIUM, and MAGNALIUM, is a threat actor that has been active since at least 2013. This group is linked to Iran and specializes in cyberespionage, targeting sectors such as government, defense, satellite, oil, and gas primarily in the U.S
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Microsoft
Espionage
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The OilRig Threat Actor is associated with Elfin. OilRig, also known as APT34, Earth Simnavaz, Evasive Serpens, and other names, is a well-known threat actor in the cybersecurity industry. This group has been particularly active in targeting entities in the Middle East, including critical infrastructure and telecommunications organizations. One of Unspecified
2