APT33
Threat actorAttributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT33Our name
- HOLMIUMMicrosoft
- Peach SandstormMicrosoft
- ElfinSymantec
Targets
Sectors: Energy, Aerospace
Regions: United States, South Korea, Saudi Arabia
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.004LSA Secrets
- T1003.005Cached Domain Credentials
- T1027.013Encrypted/Encoded File
- T1040Network Sniffing
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
- T1053.005Scheduled Task
- T1059.001PowerShell
- T1059.005Visual Basic
- T1068Exploitation for Privilege Escalation
- T1071.001Web Protocols
- T1078Valid Accounts
- T1078.004Cloud Accounts
- T1105Ingress Tool Transfer
- T1110.003Password Spraying
- T1132.001Standard Encoding
- T1203Exploitation for Client Execution
- T1204.001Malicious Link
- T1204.002Malicious File
- T1546.003Windows Management Instrumentation Event Subscription
- T1547.001Registry Run Keys / Startup Folder
- T1552.001Credentials In Files
- T1552.006Group Policy Preferences
- T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers
- T1560.001Archive via Utility
- T1566.001Spearphishing Attachment
- T1566.002Spearphishing Link
- T1571Non-Standard Port
- T1573.001Symmetric Cryptography
- T1588.002Tool
Malware and tools used
AutoIt backdoorDEADWOODEmpireftpLaZagneMimikatzNanoCoreNetNETWIREPoshC2PowerSploitPOWERTONPupyRulerStoneDrillTURNEDUP
Source: MITRE ATT&CKRecent news
No stories yet.