APT33

Overview

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

Targets

Private sector

Regions

Saudi Arabia · South Korea · United States

Capabilities

• Destructive / data-wiping operations — software: StoneDrill
• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 7 attributed custom malware families
• Documented tooling: STONEDRILL wiper, variants of TURNEDUP malware — MISP galaxy (meta.capabilities)

TTPs — 31 techniques across 10 tactics

Tools & malware (16)

PowerSploit · AutoIt backdoor · PoshC2 · Ruler · Mimikatz · NanoCore · DEADWOOD · StoneDrill · POWERTON · LaZagne · TURNEDUP · NETWIRE · Net · Pupy · Empire · ftp

Reporting (3)

• How Microsoft names threat actors — Microsoft
• Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint — Microsoft Threat Protection Intelligence Team
• Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S — Security Response attack Investigation Team