Actors Insights|Latest update08/07/2026

Refined Kitten

Named by CrowdStrikeSuspected state sponsor: Islamic Republic of Iran

Refined Kitten is CrowdStrike's designation for the Iranian state-sponsored threat actor known as APT33. The group has been active since at least 2013, focusing on cyber espionage against aerospace, energy, and defense organizations across the United States, Saudi Arabia, and South Korea. Operations attributed to this name share the same tradecraft as the broader APT33 cluster: spear phishing with recruitment-themed lures, password spraying, and custom backdoor deployment. The cluster is also tracked as Peach Sandstorm (Microsoft), Elfin (Symantec), and HOLMIUM (Microsoft legacy).

First Seen:Jan 2013
Last Seen:Dec 2019
Indexed Reports:1
Public IOCs:0
Cluster: APT33Misp: APT33
also known as:
APT 33Elfin (Symantec)Magnallium (Dragos)Refined Kitten (CrowdStrike)HOLMIUM (Microsoft)COBALT TRINITY (SecureWorks)G0064 (Mitre)ATK35 (Thales)Peach Sandstorm (Microsoft)TA451 (Proofpoint)

Targeted Regions

Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
United States
US
United States
United States
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Dec 2019
Jan 2013Jun 2026

Targeted Sectors

DefenseAerospaceEnergyOil and Gas

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.