APT33 has used FTP to exfiltrate files (separately from the C2 channel).(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT33 has used HTTP for command and control.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT33 has deployed a tool known as

DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

APT33 has utilized PowerShell to download files from the C2 server and run various scripts. (Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT33 has downloaded additional files and programs from its C2 server.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)

APT33 has used WinRAR to compress data prior to exfil.(Citation: Symantec Elfin Mar 2019) 
|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.001|LSASS Memory|

APT33 has used a variety of publicly available tools like

LaZagne,

Mimikatz, and ProcDump to dump credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|