Quick links
Press Enter to search, Esc to close
Threat group profile
MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and energy in the United States, Saudi Arabia and South Korea.
In short
MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and energy in the United States, Saudi Arabia and South Korea. CERT-EU's March 2024 brief calls it an Iranian-linked cyberespionage group; no government indictment or sanction naming it was found.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT33 | MITRE ATT&CK group page G0064[1] |
| HOLMIUM | MITRE ATT&CK Associated Groups[1] |
| Elfin | MITRE ATT&CK Associated Groups; CERT-EU brief 24-04[1, 10] |
| Peach Sandstorm | MITRE ATT&CK Associated Groups; CERT-EU brief 24-04[1, 10] |
| Curious Serpens | CERT-EU brief 24-04 (not on the MITRE list)[10] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK page modified 31 July 2026
Describes APT33 as a suspected Iranian threat group that has carried out operations since at least 2013. It names no sponsoring agency.[1]
MITRE ATT&CK software page
Describes the StoneDrill wiper, which destroys data, as found in destructive campaigns against Middle Eastern and European targets "in association with APT33".[3]
MITRE ATT&CK software page
Describes the POWERTON backdoor, first observed in 2018, as typically deployed late in an intrusion by APT33.[2]
MITRE ATT&CK software page
Says the DEADWOOD wiper was previously linked to APT33 operations in 2019 and has since been incorporated into Agrius operations.[1, 5]
CERT-EU March 2024
Calls the actor Curious Serpens, also known as Peach Sandstorm, APT33 and Elfin, an Iranian-linked cyberespionage group that has previously targeted the aerospace and energy sectors.[10]
Sources differ in wording. MITRE ATT&CK calls APT33 a "suspected" Iranian group, while CERT-EU calls the actor "Iranian-linked". Neither names an agency or unit. CERT-EU describes the group as cyberespionage, while MITRE also links it to wiper malware, which destroys data. On DEADWOOD, MITRE's group page says it was linked to APT33 operations in 2019, but the DEADWOOD software page calls the first 2019 wiping event "unattributed" and says the tool is now used by Agrius.
Each entry is attributed to the group by the sources cited.
MITRE says APT33 has carried out operations since at least 2013.[1]
The MITRE page for the group was created. This dates the record, not an attack.[1]
MITRE says POWERTON, a custom PowerShell backdoor, was first observed in 2018.[2]
CERT-EU's March 2024 brief says an Iranian-linked actor, Curious Serpens, mimicked human resources software with a fake job recruitment process to install a backdoor.[10]
MITRE shows version 2.0 of the page, last modified on this date. This dates the record, not an attack.[1]
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Link T1566.002
MITRE says APT33 sent spearphishing emails with links to .hta files, which are HTML applications that run code.[1]
Valid Accounts: Cloud Accounts T1078.004
MITRE says APT33 used compromised Office 365 accounts together with the Ruler tool to try to take control of endpoints.[1]
POWERTON Backdoor
A custom PowerShell backdoor first observed in 2018, typically deployed late in an intrusion by APT33, per MITRE.[2]
StoneDrill Wiper
Destroys data. MITRE says it was found in destructive campaigns in association with APT33.[3]
TURNEDUP Backdoor
A non-public backdoor that MITRE says was dropped by StoneDrill.[4]
DEADWOOD Wiper
MITRE says it was previously linked to APT33 operations in 2019 and is now used by Agrius, so treat the two groups as separate.[1, 5]
Ruler Public tool
Abuses Microsoft Exchange services. MITRE says APT33 used it with compromised Office 365 accounts.[1, 6]
LaZagne Public tool
Recovers stored passwords. MITRE lists it among the public tools APT33 used to gather credentials.[1, 7]
Mimikatz Public tool
Dumps Windows credentials. MITRE lists it among the tools APT33 used.[1, 8]
Empire Public tool
An open-source post-exploitation framework that MITRE lists for APT33.[1, 9]
Disable legacy authentication, which cannot use multi-factor, and require modern sign-in.
Counters T1078
Use SPF, DKIM and DMARC to filter messages from spoofed sender domains.
Counters T1566.002
Block unknown or unused file types in transit by default and use network protection to stop malicious downloads.
Counters T1204.001
Apply patch management on endpoints and servers so public exploits for old flaws fail.
Counters T1068
Enable Windows Attack Surface Reduction rules to secure LSASS and prevent credential stealing.
Counters T1003.001
Set PowerShell to run only signed scripts and use application control where it fits.
Counters T1059.001
Follow new government advisories and MITRE updates on APT33 and its listed names (HOLMIUM, Elfin, Peach Sandstorm, Curious Serpens), and check whether your aviation, aerospace or energy business matches the targeting they describe.
See which internet-facing sign-in pages and services are exposed, since MITRE lists password spraying and valid accounts as entry methods.
Watch for leaked or sold company credentials that could be used for valid account access.
Spot fake sites and lookalike domains that imitate your brand, since MITRE lists spearphishing links among the entry methods.
MITRE ATT&CK describes it as a suspected Iranian threat group that has carried out operations since at least 2013. It names no sponsoring agency.
MITRE lists organizations across several industries in the United States, Saudi Arabia and South Korea, with a particular interest in aviation and energy. CERT-EU says the actor previously targeted aerospace and energy.
MITRE lists spearphishing emails with links to .hta files, password spraying, and valid accounts including compromised Office 365 accounts.
The only dated government report found is a CERT-EU brief of March 2024. MITRE last modified its page on 31 July 2026, but that is a record date, not a report of activity.
MITRE describes the StoneDrill wiper as found in destructive campaigns in association with APT33. Sources differ on the DEADWOOD wiper, so no link is claimed beyond MITRE's wording.
Turn on multi-factor authentication, especially on externally facing services, and train staff on spearphishing links (MITRE mitigations for T1110.003 and T1566.002).
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.