216.73.217.22

APT33

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:14 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:14
Updated at
27/03/2026 01:14
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
25 attack patterns (mitre), 8 malware, 6 sectors, 3 countries, 9 indicators, 9 tool

Aliases

HOLMIUM Elfin Peach Sandstorm

Description

[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (25 / 43)

Malware (8)

  • AutoIt backdoor
  • DEADWOOD
  • NETWIRE
  • NanoCore
  • Tickler uses
    Family
    Published 04/03/2026 15:30 · Modified 04/03/2026 15:30
  • TURNEDUP
  • StoneDrill
  • POWERTON

Sectors (6)

  • Government targets
  • Aerospace targets
  • Pharmacy and drugs manufacturing targets
  • Energy targets
  • Defense targets
  • Education targets

Countries (3)

  • United Arab Emirates targets
  • United States of America targets
  • Australia targets

Indicators (9)

Tool (9)

  • PowerSploit uses
    The MITRE Corporation Confidence 100

    [PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules and scripts that perform a wide range of tasks related to penetration testing such as code …

    Published 18/04/2018 19:59 · Modified 27/03/2026 01:07
  • PoshC2 uses
    The MITRE Corporation Confidence 100

    [PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while …

    Published 23/04/2019 14:31 · Modified 27/03/2026 01:07
  • Pupy uses
    The MITRE Corporation Confidence 100

    [Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as …

    Published 18/04/2018 19:59 · Modified 27/03/2026 01:07
  • LaZagne uses
    The MITRE Corporation Confidence 100

    [LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows …

    Published 30/01/2019 17:44 · Modified 27/03/2026 01:07
  • Empire uses
    The MITRE Corporation Confidence 100

    [Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents …

    Published 11/03/2019 15:13 · Modified 27/03/2026 01:07
  • Ruler uses
    The MITRE Corporation Confidence 100

    [Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S0358) …

    Published 04/02/2019 19:27 · Modified 27/03/2026 01:07
  • Net uses
    The MITRE Corporation Confidence 100

    The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • ftp uses
    The MITRE Corporation Confidence 100

    [ftp](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a …

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07