APT33 has used compromised Office 365 accounts in tandem with

Ruler in an attempt to gain control of endpoints.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

APT33 has used HTTP over TCP ports 808 and 880 for command and control.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1552.006|Group Policy Preferences|

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.005|Cached Domain Credentials|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.004|LSA Secrets|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|