APT33 - G0064

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-08T22:07:25.123Z

Contributors: Dragos  Threat  Intelligence

Aliases

APT33,HOLMIUM,Elfin

Description

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors. (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)

Techniques Used

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.(Citation: FireEye APT33 Guardrail)(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT33 has sent spearphishing e-mails with archive attachments.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT33 has used malicious e-mail attachments to lure victims into executing malware.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT33 has used VBScript to initiate the delivery of payloads.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1078.004|Cloud Accounts|

APT33 has used compromised Office 365 accounts in tandem with