# Apt33 Elfin

> Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.

- Skill: `purpleailab/apt33-elfin` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/apt33-elfin`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/apt33-elfin/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/apt33-elfin

---


# APT33 (Elfin, Peach Sandstorm, HOLMIUM) — Adversary Emulation Profile

APT33 (MITRE ATT&CK **G0064**; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from `.hta`-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked — with varying confidence — to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.

## Attribution & motivation

- **Suspected sponsor / nation:** Iran. FireEye/Mandiant assessed APT33 works at the behest of the Iranian government and reported evidence linking the group to the Nasr Institute, an Iranian organization associated with cyber-warfare operations. Microsoft tracks the same actor as **Peach Sandstorm** and likewise attributes it to Iranian state interests.
- **Primary motivation:** Strategic **espionage / intelligence collection** aligned with Iranian state interests (aerospace, defense, energy). Microsoft assessed the 2023 password-spray campaign was likely intended to facilitate intelligence collection supporting Iranian state objectives.
- **Secondary / destructive dimension:** APT33 has been *linked* to the **StoneDrill** wiper, which shares similarities with the Shamoon family used against Saudi Aramco and RasGas (2012). Confidence on the destructive link is **lower than the espionage attribution** — Kaspersky and FireEye both noted it is unproven whether the Shamoon and StoneDrill operators are the same group or merely aligned in interests/region. Treat any destructive capability claim as plausible-but-unconfirmed.
- **Attribution confidence:** Moderate-to-high for Iranian state-sponsored espionage (multiple independent vendors converge: FireEye/Mandiant, Symantec, Microsoft). Lower for the destructive/wiper attribution.

## Targeting

- **Sectors:** Aviation (both military and commercial), energy with ties to petrochemical production (Mandiant 2017); chemical, engineering, manufacturing, consulting, finance, telecoms, research, and government (Symantec 2019). More recently: **satellite, defense, the Defense Industrial Base (DIB), pharmaceutical, communications, oil & gas, and government** (Microsoft 2023–2024).
- **Regions:** Historically concentrated on **Saudi Arabia** (Symantec attributed ~42% of observed Elfin attacks since 2016) and the **United States** (including Fortune 500 firms), plus **South Korea**. Recent Peach Sandstorm campaigns are global, including the U.S. and UAE.
- **Victim profile:** Organizations of strategic interest to Iran — aerospace/defense contractors and supply-chain subcontractors, energy/petrochemical operators, and satellite/communications providers. Spearphishing has often targeted individuals in aviation-related roles using recruitment/job-themed lures.

## Notable campaigns

- **2016–mid 2017 — Aviation & petrochemical intrusions.** APT33 compromised a U.S. aviation organization and targeted a Saudi business conglomerate with aviation holdings and a South Korean oil-refining/petrochemical company; May 2017 lures impersonated job vacancies at a Saudi petrochemical firm. (FireEye/Mandiant, "APT33: Insights into Iranian Cyber Espionage," Sept 2017.)
- **2017 — StoneDrill wiper discovery.** Kaspersky disclosed StoneDrill, a destructive wiper found in campaigns against Middle Eastern and European targets and linked to APT33-aligned activity, with conceptual similarities to Shamoon. (Kaspersky/Securelist, "From Shamoon to StoneDrill," 2017.)
- **Feb 2019 — Elfin / WinRAR exploitation.** Symantec reported the Elfin (APT33) group attacked ~50 organizations across Saudi Arabia, the U.S., and other countries, and attempted to exploit **CVE-2018-20250** (WinRAR ACE) against a Saudi chemical-sector target. (Symantec, "Elfin: Relentless Espionage Group," Mar 2019.)
- **Feb–Jul 2023 — Peach Sandstorm password-spray.** Microsoft observed large-scale password-spray authentication attempts against thousands of organizations in satellite, defense, and pharmaceutical sectors, followed by Entra ID reconnaissance with AzureHound/Roadtools on successful compromises. (Microsoft, "Peach Sandstorm password spray campaigns," Sept 14 2023.)
- **Nov–Dec 2023 — FalseFont backdoor against the DIB.** Microsoft observed Peach Sandstorm delivering the custom **FalseFont** backdoor to Defense Industrial Base organizations, enabling remote access, file launch, and C2 exfiltration. (Microsoft / The Hacker News / BleepingComputer, Dec 2023.)
- **Apr–Jul 2024 — Tickler malware & Azure abuse.** Microsoft reported Peach Sandstorm deploying the custom multi-stage **Tickler** backdoor against satellite, communications, oil & gas, and U.S./UAE government targets, using fraudulent Azure subscriptions (compromised education-sector accounts) for Azure App Service C2 nodes, plus LinkedIn social engineering and SMB lateral movement. (Microsoft, "Peach Sandstorm deploys new custom Tickler malware," Aug 28 2024.)

## TTPs by ATT&CK tactic

**Initial Access**
- `T1566.001` — Spearphishing Attachment: archive attachments delivered in spearphishing emails.
- `T1566.002` — Spearphishing Link: emails linking to malicious `.hta` HTML application files (recruitment/job lures).
- `T1110.003` — Password Spraying: large-scale spray against cloud/Internet-facing auth to gain initial footholds (Peach Sandstorm 2023, low-and-slow with `go-http-client` UA).
- `T1078` / `T1078.004` — Valid Accounts (incl. Cloud Accounts): use of compromised credentials, including Office 365 / Microsoft 365 accounts (historically with the Ruler tool).
- `T1203` — Exploitation for Client Execution: WinRAR `CVE-2018-20250` and Outlook `CVE-2017-11774`.

**Execution**
- `T1059.001` — PowerShell: download payloads from C2 and run scripts.
- `T1059.005` — Visual Basic: VBScript to initiate payload delivery.
- `T1204.001` / `T1204.002` — User Execution (Malicious Link / Malicious File): luring users to click `.hta` links or open malicious attachments.

**Persistence**
- `T1547.001` — Registry Run Keys: used for DarkComet-style autostart persistence.
- `T1546.003` — WMI Event Subscription: WMI subscriptions for persistence.
- `T1053.005` — Scheduled Task: `.vbe` execution scheduled to run multiple times per day.

**Privilege Escalation**
- `T1068` — Exploitation for Privilege Escalation: `CVE-2017-0213`.
- `T1078` — Valid Accounts also leveraged to operate at elevated/legitimate privilege.

**Defense Evasion**
- `T1132.001` — Standard Encoding: Base64-encoded C2 traffic.
- `T1027.013` — Obfuscated/Encoded File: Base64-encoded payloads.
- (2024 Tickler) DLL sideloading via legitimate Windows binaries to blend persistence with trusted processes.

**Credential Access**
- `T1003.001` — LSASS Memory: LaZagne, Mimikatz, and ProcDump.
- `T1003.004` — LSA Secrets: LaZagne.
- `T1003.005` — Cached Domain Credentials: LaZagne.
- `T1555` / `T1555.003` — Credentials from Password Stores / Web Browsers: LaZagne.
- `T1040` — Network Sniffing: SniffPass for credential capture.
- `T1552.001` — Credentials In Files: LaZagne file-based credential discovery.
- `T1552.006` — Group Policy Preferences: Gpppassword to recover GPP-stored credentials.

**Discovery**
- Active Directory and Microsoft Entra ID reconnaissance: AzureHound (via Microsoft Graph / Azure REST APIs) and Roadtools against cloud tenants after successful auth; AD snapshot extraction on-prem.

**Lateral Movement**
- SMB-based propagation across the network following initial compromise (Peach Sandstorm 2024); attempted deployment of AnyDesk remote management for access.

**Collection**
- `T1560.001` — Archive via Utility: WinRAR to compress data prior to exfiltration.
- `T0852` (ICS) — Screen Capture: backdoor screenshot capability.

**Command and Control**
- `T1071.001` — Web Protocols: HTTP for C2.
- `T1573.001` — Symmetric Cryptography: AES-encrypted C2 channel.
- `T1571` — Non-Standard Port: HTTP over TCP ports 808 and 880.
- `T1105` — Ingress Tool Transfer: download additional files/programs from C2.
- (2024) Azure App Service apps (e.g., `*.azurewebsites.net`) as C2 nodes under fraudulent Azure subscriptions.

**Exfiltration**
- `T1048.003` — Exfiltration Over Alternative Protocol: FTP for file exfiltration separate from the C2 channel.

**Impact**
- StoneDrill (`S0380`) wiper capability — destructive disk-wiping linked to APT33-aligned activity (attribution lower-confidence; conceptually related to Shamoon).

**Resource Development / ICS-adjacent**
- `T1588.002` — Obtain Capabilities (Tool): acquisition of publicly available offensive tools.
- `T0853` (ICS) — Scripting: PowerShell for C2 and file installation.
- `T0865` (ICS) — Spearphishing Attachment: `.hta` files with embedded malicious code.

## Signature tooling & malware

Custom families: **TURNEDUP** (`S0198`/backdoor — RAT, `S0199`), **NanoCore** (`S0336`), **NETWIRE** (`S0198`), **POWERTON** (`S0371`, PowerShell backdoor), **PoshC2** (`S0378`), **AutoIt backdoor** (`S0129`), **DEADWOOD** (`S1134`, 2019), **StoneDrill** (`S0380`, wiper), plus newer custom backdoors **FalseFont** (2023, DIB) and **Tickler** (2024, multi-stage Azure-backed). 

Publicly available / dual-use: **Mimikatz** (`S0002`), **LaZagne** (`S0349`), **PowerSploit** (`S0194`), **Empire** (`S0363`), **Pupy** (`S0192`), **Ruler** (`S0358`, Outlook/O365), **ftp** (`S0095`), **Net** (`S0039`), **ProcDump**, **SniffPass**, **Gpppassword**, **AzureHound**, **Roadtools**, and **AnyDesk** (abused RMM).

## Emulation guidance (Decepticon)

> Authorized-use only: execute these emulations strictly within the engagement's written scope, target list, and rules of engagement. Destructive/wiper TTPs must NEVER be executed against client systems — emulate Impact only via documented, reversible markers or out-of-scope-by-default.

Map APT33's signature chain to Decepticon's own capabilities:

- **Initial access — password spray (`T1110.003`) + cloud valid accounts (`T1078.004`):** This is the modern APT33 signature. Use Decepticon's cloud skills to run a low-and-slow spray against the engagement's M365/Entra ID tenant with a custom user-agent and lockout-aware throttling, mirroring the `go-http-client` low-volume pattern. Pair with the engagement's authorized credential list. Avoid lockouts to stay in scope.
- **Initial access — spearphishing (`T1566.001/.002`, `T1204`):** If phishing is in scope, emulate `.hta`/archive-attachment lures with recruitment/job themes via the engagement's sanctioned phishing harness; otherwise simulate the post-delivery effect by assuming a foothold.
- **Execution / staging (`T1059.001`, `T1105`):** Use Decepticon's bash/PowerShell tooling to fetch and run a stager from your redirector, mirroring PowerShell download-and-execute.
- **C2 — emulate with Sliver:** Stand up a Sliver HTTP listener (matches `T1071.001`), enable symmetric-crypto transport (`T1573.001`), and bind to non-standard ports analogous to 808/880 (`T1571`). For high-fidelity cloud emulation, front C2 through an authorized Azure App Service / `*.azurewebsites.net` redirector to replicate the Tickler infrastructure pattern — only with cloud-team approval.
- **Cloud/AD discovery (`AzureHound`/`Roadtools`/AD snapshot):** Use Decepticon's cloud and AD skills to enumerate Entra ID via Graph/Azure REST (AzureHound-style) and pull an AD snapshot/BloodHound collection on-prem — the exact recon APT33 runs post-auth.
- **Credential access (`T1003.001/.004/.005`, `T1555`, `T1552.006`):** Via the defense-evasion / credential workflow, emulate LSASS dumping (Mimikatz/ProcDump-style), LaZagne-style store harvesting, and GPP password recovery — log every artifact for the blue cell.
- **Lateral movement (`T1078`, SMB):** Use Decepticon's lateral-movement skill for SMB-based propagation with recovered valid accounts; optionally emulate AnyDesk RMM deployment if RMM abuse is in scope.
- **Collection & exfil (`T1560.001`, `T1048.003`):** Archive staged data with a WinRAR-equivalent utility, then exfiltrate over a *separate* FTP channel distinct from C2 to reproduce APT33's split-channel pattern.
- **Defense evasion (`T1132.001`, `T1027.013`, DLL sideloading):** Base64-encode tasking/payloads and emulate DLL sideloading against a benign legitimate binary to test the blue cell's sideload detection.
- **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Plant a Run-key, a WMI event subscription, and a recurring scheduled task (multiple daily triggers) as APT33 does — document each for clean teardown.

## Detection & defense

- **Password spray / cloud identity (`T1110.003`, `T1078.004`):** Enforce phishing-resistant MFA, conditional access, and risk-based sign-in policies; alert on high-volume failed auth from single/few source IPs, anomalous user-agents (e.g., `go-http-client`), and impossible-travel. Monitor for fraudulent Azure subscription creation and unexpected Azure App Service deployments.
- **Spearphishing / `.hta` (`T1566`, `T1204`):** Block/inspect `.hta` and archive attachments at the gateway; disable `mshta.exe` where feasible; user-awareness on recruitment-themed lures.
- **Exploits (`T1203`, `T1068`):** Patch WinRAR (CVE-2018-20250), Outlook (CVE-2017-11774), and Windows (CVE-2017-0213); restrict legacy archive utilities.
- **Cloud/AD recon (AzureHound/Roadtools):** Monitor Microsoft Graph / Azure REST enumeration spikes from newly authenticated principals; alert on bulk directory reads and AD snapshot/`ntds`-style access.
- **Credential access (`T1003.x`):** Enable LSASS protection (PPL/Credential Guard), alert on ProcDump/Mimikatz LSASS handle access, and remediate GPP passwords (KB2962486).
- **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Baseline Run keys, WMI event subscriptions, and scheduled tasks; alert on `.vbe`/`.hta`-spawned task creation.
- **C2 / exfil (`T1071.001`, `T1571`, `T1573.001`, `T1048.003`):** Inspect HTTP on non-standard ports (808/880), flag long-lived beaconing to `*.azurewebsites.net` not tied to business use, and alert on outbound FTP to non-approved hosts.
- **Lateral movement / RMM:** Detect anomalous SMB admin-share writes and unauthorized AnyDesk/RMM installation.
- **Impact (wiper):** Maintain tested offline backups and EDR rules for mass file overwrite / MBR tampering given the StoneDrill/Shamoon-adjacent risk.

## Sources

- https://attack.mitre.org/groups/G0064/
- https://www.mandiant.com/resources/blog/apt33-insights-into-iranian-cyber-espionage
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/elfin-apt33-espionage
- https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/
- https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations/
- https://thehackernews.com/2023/12/microsoft-warns-of-new-falsefont.html
- https://www.bleepingcomputer.com/news/security/microsoft-hackers-target-defense-firms-with-new-falsefont-malware/
- https://securelist.com/from-shamoon-to-stonedrill/77725/
- https://attack.mitre.org/software/S0380/