APT33 (also Elfin, HOLMIUM and Peach Sandstorm) is a suspected Iranian cyber espionage group. MITRE ATT&CK says it has been active since at least 2013. MITRE reports a particular interest in aviation and energy. CERT-EU (March 2024) calls the actor Iranian-linked. No government agency is named as its sponsor in the sources we reviewed.
| Also known as | Elfin, HOLMIUM, Peach Sandstorm |
| Attributed to | Not named; MITRE ATT&CK describes it as a suspected Iranian group |
| Attributed by | MITRE ATT&CK; CERT-EU (March 2024) |
| Active since | At least 2013 (MITRE ATT&CK) |
| MITRE ATT&CK ID | G0064 |
| Main targets | Aviation and energy, plus other industries, in the United States, Saudi Arabia and South Korea |
Full sources, timeline and government actions are in the APT33 threat group profile.
Introduction
APT33 also called Elfin, Refined Kitten, and Magnallium is one of Iran’s most active and long-lasting cyber-espionage groups. The group has been operational since at least 2013 and has demonstrated persistence in campaigns against targets in the aerospace, energy, and defense industries. Some analysts link APT33 to Iran’s Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS). That is not an official attribution: MITRE ATT&CK calls APT33 only a suspected Iranian group, and no government source we reviewed names an agency. In the last ten years, APT33 has shifted from disruptive wiper attacks to more advanced, deliberate, and sustained espionage campaigns. These campaigns are aligned with Tehran’s geopolitical objectives.
APT33’s activities show a growing cyber maturity for the Iranian state. They also show its wish to make up for a lack of conventional military capacity through asymmetric capabilities. The group focuses on intelligence collection, on gaining economic advantage, and potentially on sabotage. This places it at the forefront of Iran’s cyber ecosystem, along with groups such as APT34 (OilRig), APT35 (Charming Kitten), and APT39 (Chafer).
- Aliases
- Elfin, Refined Kitten, Magnallium
- Active since
- At least 2013
- Targets
- Aerospace, energy and defense industries
- Main method
- Spearphishing
- Linked by analysts to
- Iran’s IRGC and MOIS
Who Is APT33 and What Motivates It?
Some analysts say APT33 works under IRGC supervision; no government source we reviewed confirms this. Its campaigns demonstrate dual-purpose motivation:
- Strategic Espionage: Compromising the networks of defense contractors, aerospace manufacturers, and energy industries to acquire sensitive data. This data can help Iran’s industrial and military efforts.
- Economic and Political Influence: Disrupting or surveilling adversaries in the Gulf region and Western countries to obtain knowledge about sanctions, energy production, and foreign policy.
The group’s main targets, defense and energy, are aligned with Iran’s strategic interests. These are protecting oil and gas interests, enhancing its missile and aerospace capabilities, and countering Western influence in the Middle East.
Tactics, Techniques, and Procedures (TTPs)
APT33 has displayed the characteristics of Iranian cyber-espionage through disciplined spearphishing, multi-stage intrusions, and a high reliance on private and open-source tools. Over time, it has adapted to add identity compromise and cloud persistence.
1. Initial Access
APT33 mainly gains initial access with spearphishing emails. These impersonate legitimate corporate emails or job-related emails from well-known aerospace and defense companies, such as Boeing or Northrop Grumman. Malicious attachments or links will deploy initial loaders that ultimately lead to backdoors being installed. APT33 also takes advantage of public-facing vulnerabilities and utilizes stolen credentials from previous breaches.
2. Persistence and Privilege Escalation
APT33 achieves persistence through web shells, scheduled tasks, and PowerShell-based backdoors. The group continuously reuses credentials and establishes active directory accounts for long-term persistent access to the network. APT33’s recent campaigns include evidence of malicious cloud-based persistence mechanisms via Azure Active Directory Applications.
3. Command and Control (C2)
APT33 utilizes HTTPS, DNS tunneling, and proxy servers located in the Middle East and Europe to facilitate command and control communications with compromised systems. This use of regionally hosted infrastructure helps to obfuscate attribution and enables continuity of operations.
4. Malware Arsenal
APT33 has a variety of tools comprised of wholly custom malware, and malware shared among the Iranian user base:
- DropShot: a loader that delivers additional payloads and maintains persistence.
- TurnedUp: a backdoor for exfiltration and monitoring.
- ALMA: an implant created in or around 2024 for espionage and exfiltration of credentials.
- Shamoon Association: the malware group behind the 2016 attacks that destroyed chunks of Saudi energy infrastructure.
- PowerShell Scripts: utilities used for reconnaissance, lateral movement, and credential exfiltration.
APT33’s modular architecture lends itself to flexibility and reuse of items developed previously in different campaigns.
5. Exfiltration and Destruction
Although its primary function appears to be espionage, APT33 has a history of destroying data. In certain events the actor deployed destructive disk wiping malware similar to Shamoon. It used this malware to wipe data and disrupt critical infrastructure. Exfiltration of data appears normally over encrypted sessions (HTTPS) or through cloud above private or open servers.
- SpearphishingEmails impersonate legitimate corporate or job emails
- LoadersMalicious attachments or links deploy initial loaders
- BackdoorsThe loaders ultimately lead to backdoors being installed
- PersistenceWeb shells, scheduled tasks and PowerShell-based backdoors
- Command and controlHTTPS, DNS tunneling and proxy servers
- ExfiltrationData normally leaves over encrypted sessions (HTTPS) or through cloud
Notable Operations
The operational history of APT33 (an Iranian state-sponsored actor) shows both sophistication and agility. It illustrates how Iranian threat actors evolve for national benefit.
- 2016 – Saudi Energy Attacks: Linked to destructive Shamoon-style incidents on Saudi petrochemical assets in a campaign. The intended objective was to quickly disrupt energy production in the region with elevated geopolitical tensions.
- 2018 – Aerospace Espionage Campaign: Executed phishing attacks to impersonate major aerospace and defense capabilities to supplant U.S. and European supply chains. This campaign was indicative of Iran’s interest in aerospace and missile capabilities.
- 2021 – Academic Espionage: Conducted operations targeting U.S. and European universities and research institutions engaged in aerospace and nuclear research likely for repurposing of stolen data for domestic defense projects in Iran.
- 2024 – ALMA Backdoor Deployment: Introduced a new PowerShell-based implant in operations targeting defense contractors and logistics firms in North America and the Gulf region.
- 2025 – Energy Sector Reconnaissance: Initiated campaigns targeting energy and oilfield service companies employing phishing and credentials harvesting to map industrial control networks.
These operations reflect a consistent focus on the energy and defense industries, to demonstrate long-term objectives around self-sustainability and strategic deterrence.
Earlier APT33 campaigns, 2016 to 2019
Public reporting from 2016 to 2019 shows APT33 phishing aerospace and petrochemical firms and, by 2019, also password spraying cloud-hosted services.
- 2016 to 2017Aerospace and petrochemical targetsRecruitment-themed spear phishing with links to malicious .hta files.
- 2017 to 2018Engineering sectorEmail client manipulated with stolen credentials; CVE-2017-11774 used.
- February 2019Chemical company in Saudi ArabiaCompressed file exploited CVE-2018-20250.
- June 2019Two phishing campaigns: US organizations including federal agencies, and financial institutions in the Middle East and USMacro documents used against the financial institutions.
- Mid-June to at least October 2019Password sprayingCloud-hosted infrastructure of various industries.
- August 2019Spoofed US defense contractor domainsCareer-themed phishing emails that delivered malware.
How Has APT33’s Tradecraft Evolved?
APT33’s development reflects the broader evolution in Iranian proxy activity from destructive cyber activity to an espionage and long-term access orientation. Early in their evolution, APT33’s campaigns were louder, easily attributable, and often left traces in network logs. Between 2023 and 2025, the group transitioned to quieter methods—exploiting identity-based attacks, using improved modular implants, and advancing operational security measures (OPSEC).
Some key trends in their evolution include:
- Operational Segmentation: an investigative or initial access team, a lateral movements team, and a C2 or infrastructure team segment the operation, which reduces exposure in each stage.
- Cloud Adoption: APT33 began using Microsoft Azure and Microsoft 365 for persistence and lateral movement. This resembles the operational practice of both Russian and Chinese cyber gangs.
- Collaborating More: Sharing tools and infrastructure to coordinate attacks with APT34 and MuddyWater lends credibility to a unified Iranian cyber command.
- Intelligence Collection Focus: APT33 has progressed from outright destruction to strategic investments in intelligence and long-term collection with an eye towards geopolitical currency and leverage.
Strategic Impact and Defensive Recommendations
APT33’s ongoing targeting of energy and defense sectors demonstrates the geopolitical nature of cyber operations in relation to the cyber world. APT33’s activity telegrams Iran’s objectives of economic survival, regional influence, and technology parity against adversaries.
Strategic Impact
- Intellectual Property Theft: Information obtained from aerospace and defense sectors could contribute to the expeditious execution of Iran’s domestic development programs.
- Threat to Critical Infrastructure: Targeting of the energy sector could allow for Iran’s pre-positioning of malware for future attacks and/or disruption.
- Regional Power Projection: APT33 operations support Iran’s asymmetric strategy by generating influence in regional issues while not having to engage in direct conflict with adversaries.
Defensive Recommendations
- Enhance Email Security: Utilize anti-phishing gate and also, sandboxing and user awareness training.
- Implement Multi-Factor Authentication (MFA): Implement MFA for remote access and cloud services to mitigate credential theft.
- Network Monitoring: Investigate anomalous PowerShell execution, lateral movement tools, and account creation of domain accounts.
- Threat Hunting: Seek potential indicators of suspected perimeter compromises associated with DropShot, TurnedUp, and ALMA malware family groups and possible malware characteristics.
- Information Sharing: Share information and develop a common understanding amongst the energy sector and defense sector regarding possible overlapping infrastructure linked to Iranian operations.
- Enhance email securityAnti-phishing gate, sandboxing and user awareness training.
- Implement MFAFor remote access and cloud services, to mitigate credential theft.
- Monitor the networkAnomalous PowerShell execution, lateral movement tools and domain account creation.
- Hunt for threatsIndicators tied to DropShot, TurnedUp and ALMA malware families.
- Share informationAcross the energy and defense sectors, on overlapping infrastructure.
Conclusion
APT33 is still one of Iran’s most effective and enduring actors in cyber-espionage. A decade-long history reflects a disciplined and strategic mission to support Iran’s military and industrial interests in cyberspace. From the early, destructive Shamoon-style campaigns to its current focus on cloud-based espionage, APT33 continues to advance in sophistication and capability.
As we look forward to 2025, APT33 illustrates Iran’s transition from less mature cyber operations to more mature and intelligence-based operations. APT33 operates in the intersection of espionage, economic warfare, and geopolitical competition. For defenders, two things are key to defending against one of the Middle East’s most prolific cyber threats. They need to understand APT33’s evolving tactics. They also need sufficient identity, email, and cloud security controls.
You can download and review the sheet for all the details!
ThreatWatch encouraging users to check their security score