MITRE ATT&CKgroup

G0064 APT33

Published 2018-04-18 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Aliases
HOLMIUM, Elfin, Peach Sandstorm
Version
2.0
Created
2018-04-18

Description

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

Related

Uses · MITRE ATT&CK (50)

  • T1701.001 PowerShell sub-technique
  • S1134 DEADWOOD software (malware)
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1588.002 Tool sub-technique
  • T0852 Screen Capture technique
  • T0865 Spearphishing Attachment technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1571 Non-Standard Port technique
  • T1078.004 Cloud Accounts sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1003.004 LSA Secrets sub-technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1552.006 Group Policy Preferences sub-technique
  • T1555 Credentials from Password Stores technique
  • T1552.001 Credentials In Files sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
Show all 50 ›

References