APT33
APT33 is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 16 sectors, including Government and Technology, in 26 countries, including the United States and the United Kingdom. It uses 91 MITRE ATT&CK techniques and exploits 17 known CVEs.
- HOLMIUM
- Elfin
- Peach Sandstorm
- Refined Kitten
- Magnallium
- TA451
- Crafty Camel
- Origin
- Iran
- Techniques
- 91
- Exploited CVEs
- 17
- First seen
- Jan 1, 2013
- Last seen
- Aug 28, 2024
- Record updated
Who They Target.
About APT33.
APT33 is a suspected Iran-nexus cyber espionage group active since at least 2013. Public reporting tracks overlapping activity under names including HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM, Refined Kitten, TA451, Curious Serpens, Cobalt Trinity, ATK35, and NewsBeef. The group has targeted aviation, aerospace, energy, oil and gas, defense, satellite, government, education, pharmaceutical, communications equipment, financial services, healthcare, construction, manufacturing, and telecommunications organizations, with recurring emphasis on the United States, Saudi Arabia, South Korea, the United Arab Emirates, and allied aerospace or energy ecosystems. APT33/Peach Sandstorm is associated with recruitment-themed spear phishing, domain masquerading, password spraying, valid account abuse, cloud and Entra ID reconnaissance, Azure infrastructure abuse, LinkedIn-based intelligence gathering, and malware/tooling including TURNEDUP, DROPSHOT, SHAPESHIFT/StoneDrill, POWERTON, FalseFont, Tickler, NanoCore, Remcos, DarkComet, Quasar RAT, Pupy RAT, PoshC2, Ruler, Empire, AzureHound, ROADtools, AnyDesk, AD Explorer, Mimikatz, LaZagne, and ProcDump.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.