Actors Insights|Latest update08/07/2026

Elfin

Named by SymantecSuspected state sponsor: Islamic Republic of Iran

Elfin is the name assigned by Symantec to the Iranian state-sponsored threat actor widely known as APT33. The group has been active since at least 2013 and focuses on cyber espionage against organizations in the aerospace, energy, defense, and aviation sectors across the United States, Saudi Arabia, South Korea, and Europe. Elfin operations are characterized by spear phishing campaigns using recruitment-themed lures, exploitation of known vulnerabilities for initial access, and deployment of custom backdoors for persistent intelligence collection. The cluster is also tracked as Peach Sandstorm and HOLMIUM by Microsoft.

First Seen:Jan 2013
Last Seen:Oct 2019
Indexed Reports:1
Public IOCs:81
Cluster: APT33Mitre: APT33Misp: APT33
also known as:
APT 33Elfin (Symantec)Magnallium (Dragos)Refined Kitten (CrowdStrike)HOLMIUM (Microsoft)COBALT TRINITY (SecureWorks)G0064 (Mitre)ATK35 (Thales)Peach Sandstorm (Microsoft)TA451 (Proofpoint)

Targeted Regions

Belgium
BE
Belgium
Belgium
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
China
CN
China
China
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Czech Republic
CZ
Czech Republic
Czech Republic
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Jordan
JO
Jordan
Jordan
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Morocco
MA
Morocco
Morocco
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Thailand
TH
Thailand
Thailand
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
United Kingdom
GB
United Kingdom
United Kingdom
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
United States
US
United States
United States
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Dec 2015 ~ Mar 2019
Jan 2015Jul 2026

Targeted Sectors

ConsultingFinancialHigh-TechInformation TechnologyManufacturingMedicalScientific ResearchTelecommunicationUtilities

Recent Indexed Reports

  1. Public
    The Elfin Threat: Customized Malware Attacks Across Diverse Sectors

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.