apt33-elfin

• SKILL.mdcore · 16,771 bytes
• SKILL.mdcore · 16,771 bytes

# APT33 (Elfin, Peach Sandstorm, HOLMIUM) — Adversary Emulation Profile

APT33 (MITRE ATT&CK **G0064**; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from `.hta`-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked — with varying confidence — to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.

## Attribution & motivation

- **Suspected sponsor / nation:** Iran. FireEye/Mandiant assessed APT33 works at the behest of the Iranian government and reported evidence linking the group to the Nasr Institute, an Iranian organization associated with cyber-warfare operations. Microsoft tracks the same actor as **Peach Sandstorm** and likewise attributes it to Iranian state interests.
- **Primary motivation:** Strategic **espionage / intelligence collection** aligned with Iranian state interests (aerospace, defense, energy). Microsoft assessed the 2023 password-spray campaign was likely intended to facilitate intelligence collection supporting Iranian state objectives.
- **Secondary / destructive dimension:** APT33 has been *linked* to the **StoneDrill** wiper, which shares similarities with the Shamoon family used against Saudi Aramco and RasGas (2012). Confidence on the destructive link is **lower than the espionage attribution** — Kaspersky and FireEye both noted it is unproven whether the Shamoon and StoneDrill operators are the same group or merely aligned in interests/region. Treat any destructive capability claim as plausible-but-unconfirmed.
- **Attribution confidence:** Moderate-to-high for Iranian state-sponsored espionage (multiple independent vendors converge: FireEye/Mandiant, Symantec, Microsoft). Lower for the destructive/wiper attribution.

## Targeting

- **Sectors:** Aviation (both military and commercial), energy with ties to petrochemical production (Mandiant 2017); chemical, engineering, manufacturing, consulting, finance, telecoms, research, and government (Symantec 2019). More recently: **satellite, defense, the Defense Industrial Base (DIB), pharmaceutical, communications, oil & gas, and government** (Microsoft 2023–2024).