APT33
Also known as: Peach Sandstorm, HOLMIUM, Elfin, Refined Kitten
APT33 has a long-standing interest in aviation and energy. In recent years it has been associated with very large password-spraying campaigns against cloud accounts, followed by targeted intrusions at the small number of organisations where a guess succeeded.
- Public attribution
- Assessed by MITRE ATT&CK as a suspected Iranian group; Microsoft describes the overlapping Peach Sandstorm as an Iranian nation-state actor.
- Active since
- Around 2013
- Targets
- Aviation and energy
- Satellite, defence and pharmaceutical organisations
- The US, Saudi Arabia and South Korea
Notable campaigns
2013 onwardAviation and energy targeting
Operations against aviation and energy organisations in the US, Saudi Arabia and South Korea (MITRE ATT&CK).
2023Password spray campaigns
Microsoft reported password spraying against thousands of organisations from February 2023, focused on satellite, defence and pharmaceutical sectors.
Signature ATT&CK techniques
- T1110.003Brute Force: Password Spraying
- T1078.004Valid Accounts: Cloud Accounts
- T1566.002Phishing: Spearphishing Link
- T1203Exploitation for Client Execution
- T1053.005Scheduled Task/Job: Scheduled Task
- T1071.001Application Layer Protocol: Web Protocols
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Enforce MFA on all cloud identities and block legacy authentication that bypasses it.
- Use smart lockout and alert on distributed low-and-slow failed logons across many accounts.
- Ban common and breached passwords.
- Review new scheduled tasks on servers for persistence.