Actors Insights|Latest update08/07/2026

APT33

Named by MandiantSuspected state sponsor: Islamic Republic of Iran

APT33 is an Iranian state-sponsored threat actor active since at least 2013, assessed by Mandiant to work at the behest of the Iranian government. The group focuses primarily on cyber espionage against organizations in the aerospace, aviation, energy, and defense sectors across the United States, Saudi Arabia, South Korea, and other countries. APT33 is known for spear phishing campaigns using job-recruitment lures and malicious .hta files, large-scale password spray operations, and the use of destructive malware. Microsoft tracks this cluster as Peach Sandstorm and previously as HOLMIUM.

First Seen:Jan 2013
Last Seen:Aug 2024
Indexed Reports:15
Public IOCs:228
Cluster: APT33Mitre: APT33Misp: APT33
also known as:
APT 33Elfin (Symantec)Magnallium (Dragos)Refined Kitten (CrowdStrike)HOLMIUM (Microsoft)COBALT TRINITY (SecureWorks)G0064 (Mitre)ATK35 (Thales)Peach Sandstorm (Microsoft)TA451 (Proofpoint)

Targeted Regions

Belgium
BE
Belgium
Belgium
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
China
CN
China
China
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Czech Republic
CZ
Czech Republic
Czech Republic
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Europe
EU
Europe
Europe
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
Aug 2018 ~ Dec 2018
May 2016 ~ Dec 2019
Aug 2018 ~ Dec 2018
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
Italy
IT
Italy
Italy
Dec 2019 ~ May 2020
Dec 2019 ~ May 2020
Jordan
JO
Jordan
Jordan
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Middle East
ME
Middle East
Middle East
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
Aug 2018 ~ Dec 2018
May 2016 ~ Dec 2019
May 2019 ~ Sep 2019
Aug 2018 ~ Dec 2018
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
May 2019 ~ Sep 2019
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
Morocco
MA
Morocco
Morocco
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2018 ~ Jun 2018
May 2018 ~ May 2018
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
South Korea
KR
South Korea
South Korea
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Thailand
TH
Thailand
Thailand
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
United Kingdom
GB
United Kingdom
United Kingdom
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
United States
US
United States
United States
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Nov 2017 ~ Dec 2018
Nov 2017 ~ Dec 2018
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Nov 2017 ~ Dec 2018
Nov 2017 ~ Dec 2018
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2019 ~ Sep 2019
Nov 2017 ~ Dec 2018
Nov 2017 ~ Dec 2018
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2019 ~ Sep 2019
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
Apr 2020 ~ Jul 2020
Jan 2013Jun 2026

Targeted Sectors

EnergyDefenseAerospaceFinancialGovernment Agencies and ServicesHigh-TechInformation TechnologyManufacturingRetailEducationOil and GasMilitaryUtilitiesConsultingLogisticsHealthcareResearchersTelecommunicationCivil EngineeringMediaUniversityTransportation

Recent Indexed Reports

  1. Public
    Iranian APT33 Intensifies Attacks on Multiple Sectors Worldwide
  2. Public
    Cyber Threats on the Rise: APT33 Targets Aerospace, Shipping, and Manufacturing via OneNote
  3. Public
    Shifting Domains: APT33's Evolving Network Infrastructure
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.