Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT33 · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT33

  • APT 33
  • Elfin
  • MAGNALLIUM
  • Refined Kitten
  • HOLMIUM
  • COBALT TRINITY
  • G0064
  • ATK35

state sponsor · Iran (Islamic Republic of)MITRE G0064 ↗

APT33 — ATT&CK roseAP

attack rose · 31 techniques across 10 tactics

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2017-0213, CVE-2017-11774, CVE-2018-20250

Analyst brief

misp-galaxy + mitre-attack

Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess APT33 works at the behest of the Iranian government.

Observed targets (as stated by the sources)

3 countries · 1 sectors
United StatesSaudi ArabiaSouth KoreaAssessed origin: Iran

assessed origin · Iranobserved targets · 3

countries · 3

  • United States
  • Saudi Arabia
  • South Korea

sectors · 1

  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

31 techniques · 10 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    2 techniques

  3. Execution

    6 techniques

  4. Persistence

    1 technique

  5. Privilege escalation

    2 techniques

  6. Stealth

    3 techniques

  7. Credential access

    9 techniques

  8. Collection

    1 technique

  9. Command and control

    5 techniques

  10. Exfiltration

    1 technique

select a technique

Arsenal

7 malware · 9 tools
Malware
Malware · 7ATT&CK
AutoIt backdoorS0129 ↗
NanoCoreS0336 ↗
DEADWOODS1134 ↗
StoneDrillS0380 ↗
POWERTONS0371 ↗
TURNEDUPS0199 ↗
NETWIRES0198 ↗
Tools
Tools · 9ATT&CK
PowerSploitS0194 ↗
PoshC2S0378 ↗
RulerS0358 ↗
MimikatzS0002 ↗
LaZagneS0349 ↗
NetS0039 ↗
PupyS0192 ↗
EmpireS0363 ↗
ftpS0095 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT33 is cited as exploiting

none on KEV
  1. CVE-2018-202502026-10-17
    1. “HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2017-02132026-10-17
    1. “APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2017-117742026-10-17
    1. “APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “The group used Ruler to configure a specially crafted Outlook Home Page URL to exploit the security bypass vulnerability CVE-2017-11774 , which was fixed shortly after it was discovered.”

      cited as exploiting · named nearby · source: microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

16 sources
  1. 1.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-irani…
  2. 2.blog.trendmicro.com/trendlabs-security-intelligence/more-than-a-dozen-obfu…
  3. 3.brighttalk.com/webcast/10703/275683
  4. 4.symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage
  5. 5.secureworks.com/research/threat-profiles/cobalt-trinity
  6. 6.attack.mitre.org/groups/G0064
  7. 7.threatconnect.com/blog/research-roundup-activity-on-previously-identifie…
  8. 8.cfr.org/interactive/cyber-operations/apt-33
  9. 9.dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
  10. 10.dragos.com/adversaries.html
  11. +6 more in the JSON record

Track APT33 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.